mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
68 lines
1.9 KiB
YAML
68 lines
1.9 KiB
YAML
---
|
|
# ExternalSecret to pull router setup key from Vault
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: netbird-router-setup-key
|
|
namespace: netbird
|
|
spec:
|
|
refreshInterval: "0"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-backend
|
|
target:
|
|
name: netbird-router-setup-key
|
|
data:
|
|
- secretKey: setup-key
|
|
remoteRef:
|
|
key: netbird-router-setup-key
|
|
property: setup-key
|
|
---
|
|
# Shared cluster-wide NetBird router deployment (2 replicas)
|
|
# Routes traffic for all exposed K8s services through NetBird VPN
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: netbird-cluster-router
|
|
namespace: netbird
|
|
labels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
annotations:
|
|
# Router pods must opt out of ambient mesh — ztunnel iptables rules
|
|
# interfere with WireGuard packet forwarding (DNS and TCP).
|
|
# AuthorizationPolicies use ipBlocks for pod CIDR instead.
|
|
ambient.istio.io/redirection: disabled
|
|
spec:
|
|
containers:
|
|
- name: netbird
|
|
image: netbirdio/netbird:0.66.0
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: NB_SETUP_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: netbird-router-setup-key
|
|
key: setup-key
|
|
- name: NB_MANAGEMENT_URL
|
|
value: "https://netbird.kube.huskypup.net"
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
terminationGracePeriodSeconds: 30
|