From c8643ca025c17385372b289fe4345302b411fdb3 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 19:27:39 -0500 Subject: [PATCH] Add dedicated netbird router for crowdsec namespace Every other major namespace (gitlab, vault, argocd, nextcloud, etc.) has its own 3-replica netbird-router deployment auto-provisioned from an NBRoutingPeer CR; crowdsec never got one since it never previously needed mesh connectivity. Without it, crowdsec pods had no dedicated mesh routing path, causing intermittent connection resets/hangs reaching the VPS proxy used to route around CrowdSec's WAF block on home's public IP. Co-Authored-By: Claude Sonnet 5 --- apps/crowdsec/manifests/netbird-router.yaml | 24 +++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 apps/crowdsec/manifests/netbird-router.yaml diff --git a/apps/crowdsec/manifests/netbird-router.yaml b/apps/crowdsec/manifests/netbird-router.yaml new file mode 100644 index 0000000..ff813bd --- /dev/null +++ b/apps/crowdsec/manifests/netbird-router.yaml @@ -0,0 +1,24 @@ +# Dedicated Netbird mesh router for the crowdsec namespace. +# +# Found missing 2026-08-17 while debugging why CrowdSec LAPI couldn't reach +# api.crowdsec.net through the VPS proxy workaround (home's public IP is +# WAF-blocked by CrowdSec's own API - see values.yaml HTTPS_PROXY comment). +# Every other major namespace (gitlab, vault, argocd, nextcloud, etc.) has +# its own 3-replica netbird-router deployment, auto-provisioned by the +# netbird-operator from an NBRoutingPeer CR - crowdsec never got one because +# it never previously needed mesh connectivity. Without it, crowdsec pods' +# mesh-bound traffic had no reliable dedicated path, causing intermittent +# connection resets/hangs to the VPS. +# +# None of the other 10 NBRoutingPeer CRs are tracked in git either (all +# created out-of-band) - this is the first one committed, to avoid it being +# similarly undiscoverable next time. +apiVersion: netbird.io/v1 +kind: NBRoutingPeer +metadata: + name: router + namespace: crowdsec + labels: + app.kubernetes.io/name: netbird-router +spec: + resources: {}