---
# ExternalSecret to pull router setup key from Vault
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: netbird-router-setup-key
  namespace: netbird
spec:
  refreshInterval: "0"
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-backend
  target:
    name: netbird-router-setup-key
  data:
    - secretKey: setup-key
      remoteRef:
        key: netbird-router-setup-key
        property: setup-key
---
# Shared cluster-wide NetBird router deployment (2 replicas)
# Routes traffic for all exposed K8s services through NetBird VPN
apiVersion: apps/v1
kind: Deployment
metadata:
  name: netbird-cluster-router
  namespace: netbird
  labels:
    app.kubernetes.io/name: netbird-cluster-router
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: netbird-cluster-router
  template:
    metadata:
      labels:
        app.kubernetes.io/name: netbird-cluster-router
      annotations:
        # Router pods must opt out of ambient mesh — ztunnel iptables rules
        # interfere with WireGuard packet forwarding (DNS and TCP).
        # AuthorizationPolicies use ipBlocks for pod CIDR instead.
        ambient.istio.io/redirection: disabled
    spec:
      containers:
        - name: netbird
          image: netbirdio/netbird:0.66.0
          imagePullPolicy: IfNotPresent
          env:
            - name: NB_SETUP_KEY
              valueFrom:
                secretKeyRef:
                  name: netbird-router-setup-key
                  key: setup-key
            - name: NB_MANAGEMENT_URL
              value: "https://netbird.kube.huskypup.net"
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              memory: 128Mi
      terminationGracePeriodSeconds: 30