# Netbird Kubernetes Operator
# Auto-discovers K8s services via annotations and creates Netbird Networks
# Chart: netbird-operator/kubernetes-operator

# API key from ExternalSecret-managed secret
netbirdAPI:
  keyFromSecret:
    name: netbird-mgmt-api-key
    key: NB_API_KEY

# Explicit tag required — Kyverno disallow-latest-tag policy
routingClientImage: "netbirdio/netbird:0.66.0"

cluster:
  name: homelab
  dns: svc.cluster.local

# Enable service exposure via annotations (netbird.io/expose=true)
ingress:
  enabled: true
  namespacedNetworks: true
  allowAutomaticPolicyCreation: true

# Webhook TLS via cert-manager (already deployed)
webhook:
  enableCertManager: true
  failurePolicy: Fail

operator:
  replicaCount: 1
  image:
    pullPolicy: IfNotPresent
  metrics:
    enabled: true
    port: 8080
  resources:
    limits:
      memory: 256Mi
    requests:
      cpu: 25m
      memory: 64Mi
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL