Initial commit

infrastructure/netbird/manifests/presync-job.yaml

@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: netbird-presync
+  namespace: netbird
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: presync
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Netbird PreSync ==="
+
+              # Set PodSecurity to privileged (cluster routers need NET_ADMIN)
+              kubectl label namespace netbird pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true
+
+              # Wait for CNPG cluster
+              echo "Waiting for Netbird PostgreSQL cluster..."
+              for i in $(seq 1 60); do
+                PHASE=$(kubectl -n netbird get cluster pg-netbird -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
+                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
+                  echo "  Netbird PostgreSQL cluster ready"
+                  break
+                fi
+                echo "  waiting for pg-netbird... (attempt $i/60, phase=$PHASE)"
+                sleep 5
+              done
+
+              # Wait for OAuth secret
+              echo "Waiting for netbird-oauth-secret..."
+              for i in $(seq 1 30); do
+                if kubectl -n netbird get secret netbird-oauth-secret >/dev/null 2>&1; then
+                  echo "  Netbird OAuth secret synced"
+                  break
+                fi
+                echo "  waiting for ExternalSecret sync... (attempt $i/30)"
+                sleep 2
+              done
+
+              echo "=== Netbird PreSync Complete ==="
+      restartPolicy: Never