feat(infrastructure): add netbird-operator

[imgios]

This PR adds the netbird-operator to access the cluster from a Netbird network

[sysadmin-cosplayer]

--- HelmRelease: netbird/netbird-operator ServiceAccount: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator ServiceAccount: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,11 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+
--- HelmRelease: netbird/netbird-operator ClusterRole: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator ClusterRole: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,124 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbsetupkeys
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbsetupkeys/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbsetupkeys/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups
+  - nbresources
+  - nbroutingpeers
+  - nbpolicies
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/status
+  - nbresources/status
+  - nbroutingpeers/status
+  - nbpolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/finalizers
+  - nbresources/finalizers
+  - nbroutingpeers/finalizers
+  - nbpolicies/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - ''
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - services/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - update
+  - create
+  - delete
+
--- HelmRelease: netbird/netbird-operator ClusterRoleBinding: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator ClusterRoleBinding: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: netbird-operator-kubernetes-operator
+subjects:
+- kind: ServiceAccount
+  name: netbird-operator-kubernetes-operator
+  namespace: netbird
+
--- HelmRelease: netbird/netbird-operator Role: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator Role: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,42 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+
--- HelmRelease: netbird/netbird-operator RoleBinding: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator RoleBinding: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: netbird-operator-kubernetes-operator
+subjects:
+- kind: ServiceAccount
+  name: netbird-operator-kubernetes-operator
+  namespace: netbird
+
--- HelmRelease: netbird/netbird-operator Service: netbird/netbird-operator-kubernetes-operator-metrics

+++ HelmRelease: netbird/netbird-operator Service: netbird/netbird-operator-kubernetes-operator-metrics

@@ -0,0 +1,20 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-operator-kubernetes-operator-metrics
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+
--- HelmRelease: netbird/netbird-operator Service: netbird/netbird-operator-kubernetes-operator-webhook-service

+++ HelmRelease: netbird/netbird-operator Service: netbird/netbird-operator-kubernetes-operator-webhook-service

@@ -0,0 +1,20 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-operator-kubernetes-operator-webhook-service
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 9443
+  selector:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+
--- HelmRelease: netbird/netbird-operator Deployment: netbird/netbird-operator-kubernetes-operator

+++ HelmRelease: netbird/netbird-operator Deployment: netbird/netbird-operator-kubernetes-operator

@@ -0,0 +1,90 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-operator-kubernetes-operator
+  labels:
+    app.kubernetes.io/component: operator
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kubernetes-operator
+      app.kubernetes.io/instance: netbird-operator
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: operator
+        app.kubernetes.io/name: kubernetes-operator
+        app.kubernetes.io/instance: netbird-operator
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      serviceAccountName: netbird-operator-kubernetes-operator
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: kubernetes-operator
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        image: docker.io/netbirdio/kubernetes-operator:0.1.5
+        imagePullPolicy: IfNotPresent
+        command:
+        - /manager
+        args:
+        - --metrics-bind-address=:8080
+        - --leader-elect
+        - --health-probe-bind-address=:8081
+        - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
+        - --netbird-management-url=https://netbird.gionsihome.duckdns.org:443
+        - --cluster-name=pi3s
+        - --cluster-dns=svc.cluster.local
+        - --netbird-api-key=$(NB_API_KEY)
+        ports:
+        - name: webhook-server
+          containerPort: 443
+          protocol: TCP
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 8081
+            scheme: HTTP
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        env:
+        - name: NB_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: netbird-mgmt-api-key
+              key: NB_API_KEY
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: 8081
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: webhook-certs
+          readOnly: true
+      volumes:
+      - name: webhook-certs
+        secret:
+          defaultMode: 420
+          secretName: netbird-operator-kubernetes-operator-tls
+
--- HelmRelease: netbird/netbird-operator Certificate: netbird/netbird-operator-kubernetes-operator-serving-cert

+++ HelmRelease: netbird/netbird-operator Certificate: netbird/netbird-operator-kubernetes-operator-serving-cert

@@ -0,0 +1,19 @@

+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netbird-operator-kubernetes-operator-serving-cert
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  dnsNames:
+  - netbird-operator-kubernetes-operator-webhook-service.netbird.svc
+  - netbird-operator-kubernetes-operator-webhook-service.netbird.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: netbird-operator-kubernetes-operator-selfsigned-issuer
+  secretName: netbird-operator-kubernetes-operator-tls
+
--- HelmRelease: netbird/netbird-operator Issuer: netbird/netbird-operator-kubernetes-operator-selfsigned-issuer

+++ HelmRelease: netbird/netbird-operator Issuer: netbird/netbird-operator-kubernetes-operator-selfsigned-issuer

@@ -0,0 +1,13 @@

+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: netbird-operator-kubernetes-operator-selfsigned-issuer
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selfSigned: {}
+
--- HelmRelease: netbird/netbird-operator MutatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-mpod-webhook

+++ HelmRelease: netbird/netbird-operator MutatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-mpod-webhook

@@ -0,0 +1,38 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: netbird/netbird-operator-kubernetes-operator-serving-cert
+  name: netbird-operator-kubernetes-operator-mpod-webhook
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- clientConfig:
+    service:
+      name: netbird-operator-kubernetes-operator-webhook-service
+      namespace: netbird
+      path: /mutate--v1-pod
+  failurePolicy: Fail
+  name: mpod-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  objectSelector:
+    matchExpressions:
+    - key: app.kubernetes.io/name
+      operator: NotIn
+      values:
+      - kubernetes-operator
+  rules:
+  - apiGroups:
+    - ''
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    resources:
+    - pods
+  sideEffects: None
+
--- HelmRelease: netbird/netbird-operator NBRoutingPeer: netbird/router

+++ HelmRelease: netbird/netbird-operator NBRoutingPeer: netbird/router

@@ -0,0 +1,14 @@

+---
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  finalizers:
+  - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+  name: router
+spec: {}
+
--- HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbsetupkey-webhook

+++ HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbsetupkey-webhook

@@ -0,0 +1,33 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: netbird/netbird-operator-kubernetes-operator-serving-cert
+  name: netbird-operator-kubernetes-operator-vnbsetupkey-webhook
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- clientConfig:
+    service:
+      name: netbird-operator-kubernetes-operator-webhook-service
+      namespace: netbird
+      path: /validate-netbird-io-v1-nbsetupkey
+  failurePolicy: Fail
+  name: vnbsetupkey-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - nbsetupkeys
+  sideEffects: None
+
--- HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbresource-webhook

+++ HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbresource-webhook

@@ -0,0 +1,32 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: netbird/netbird-operator-kubernetes-operator-serving-cert
+  name: netbird-operator-kubernetes-operator-vnbresource-webhook
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- clientConfig:
+    service:
+      name: netbird-operator-kubernetes-operator-webhook-service
+      namespace: netbird
+      path: /validate-netbird-io-v1-nbresource
+  failurePolicy: Fail
+  name: vnbresource-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - nbresources
+  sideEffects: None
+
--- HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbroutingpeer-webhook

+++ HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbroutingpeer-webhook

@@ -0,0 +1,32 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: netbird/netbird-operator-kubernetes-operator-serving-cert
+  name: netbird-operator-kubernetes-operator-vnbroutingpeer-webhook
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- clientConfig:
+    service:
+      name: netbird-operator-kubernetes-operator-webhook-service
+      namespace: netbird
+      path: /validate-netbird-io-v1-nbroutingpeer
+  failurePolicy: Fail
+  name: vnbroutingpeer-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - nbroutingpeers
+  sideEffects: None
+
--- HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbgroup-webhook

+++ HelmRelease: netbird/netbird-operator ValidatingWebhookConfiguration: netbird/netbird-operator-kubernetes-operator-vnbgroup-webhook

@@ -0,0 +1,32 @@

+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: netbird/netbird-operator-kubernetes-operator-serving-cert
+  name: netbird-operator-kubernetes-operator-vnbgroup-webhook
+  labels:
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+webhooks:
+- clientConfig:
+    service:
+      name: netbird-operator-kubernetes-operator-webhook-service
+      namespace: netbird
+      path: /validate-netbird-io-v1-nbgroup
+  failurePolicy: Fail
+  name: vnbgroup-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - nbgroups
+  sideEffects: None
+
--- HelmRelease: netbird/netbird-operator Job: netbird/netbird-operator-kubernetes-operator-delete-routers

+++ HelmRelease: netbird/netbird-operator Job: netbird/netbird-operator-kubernetes-operator-delete-routers

@@ -0,0 +1,37 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: netbird-operator-kubernetes-operator-delete-routers
+  labels:
+    app.kubernetes.io/component: operator
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      name: netbird-operator-kubernetes-operator
+      labels:
+        app.kubernetes.io/component: operator
+        app.kubernetes.io/name: kubernetes-operator
+        app.kubernetes.io/instance: netbird-operator
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: pre-delete
+        image: registry.suse.com/suse/kubectl:latest
+        args:
+        - delete
+        - --all
+        - -A
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBRoutingPeer
+      serviceAccountName: netbird-operator-kubernetes-operator
+      restartPolicy: Never
+
--- HelmRelease: netbird/netbird-operator Job: netbird/netbird-operator-kubernetes-operator-delete-policies

+++ HelmRelease: netbird/netbird-operator Job: netbird/netbird-operator-kubernetes-operator-delete-policies

@@ -0,0 +1,36 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: netbird-operator-kubernetes-operator-delete-policies
+  labels:
+    app.kubernetes.io/component: operator
+    app.kubernetes.io/name: kubernetes-operator
+    app.kubernetes.io/instance: netbird-operator
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      name: netbird-operator-kubernetes-operator
+      labels:
+        app.kubernetes.io/component: operator
+        app.kubernetes.io/name: kubernetes-operator
+        app.kubernetes.io/instance: netbird-operator
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      containers:
+      - name: pre-delete
+        image: registry.suse.com/suse/kubectl:latest
+        args:
+        - delete
+        - --all
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBPolicy
+      serviceAccountName: netbird-operator-kubernetes-operator
+      restartPolicy: Never
+

[sysadmin-cosplayer]

--- kubernetes/infrastructure Kustomization: flux-system/infrastructure Namespace: flux-system/netbird

+++ kubernetes/infrastructure Kustomization: flux-system/infrastructure Namespace: flux-system/netbird

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    decrypt.homelab.local/type: sops
+    kustomize.toolkit.fluxcd.io/name: infrastructure
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: netbird
+
--- kubernetes/infrastructure Kustomization: flux-system/infrastructure Kustomization: netbird/netbird

+++ kubernetes/infrastructure Kustomization: flux-system/infrastructure Kustomization: netbird/netbird

@@ -0,0 +1,33 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    decrypt.homelab.local/type: sops
+    kustomize.toolkit.fluxcd.io/name: infrastructure
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: netbird
+  namespace: netbird
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: netbird
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  healthChecks:
+  - apiVersion: helm.toolkit.fluxcd.io/v2
+    kind: HelmRelease
+    name: netbird
+    namespace: netbird
+  interval: 10m0s
+  path: ./kubernetes/infrastructure/netbird/app/deployment
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: netbird
+  timeout: 5m0s
+
--- kubernetes/infrastructure/netbird/app/deployment Kustomization: netbird/netbird HelmRepository: netbird/netbird-helmrepo

+++ kubernetes/infrastructure/netbird/app/deployment Kustomization: netbird/netbird HelmRepository: netbird/netbird-helmrepo

@@ -0,0 +1,15 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  labels:
+    app.kubernetes.io/name: netbird
+    kustomize.toolkit.fluxcd.io/name: netbird
+    kustomize.toolkit.fluxcd.io/namespace: netbird
+  name: netbird-helmrepo
+  namespace: netbird
+spec:
+  interval: 1h0m0s
+  type: default
+  url: https://netbirdio.github.io/helms
+
--- kubernetes/infrastructure/netbird/app/deployment Kustomization: netbird/netbird HelmRelease: netbird/netbird-operator

+++ kubernetes/infrastructure/netbird/app/deployment Kustomization: netbird/netbird HelmRelease: netbird/netbird-operator

@@ -0,0 +1,31 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: netbird
+    kustomize.toolkit.fluxcd.io/name: netbird
+    kustomize.toolkit.fluxcd.io/namespace: netbird
+  name: netbird-operator
+  namespace: netbird
+spec:
+  chart:
+    spec:
+      chart: kubernetes-operator
+      sourceRef:
+        kind: HelmRepository
+        name: netbird-helmrepo
+  interval: 1h0m0s
+  values:
+    cluster:
+      name: pi3s
+    ingress:
+      enabled: true
+      router:
+        enabled: true
+    managementURL: https://netbird.gionsihome.duckdns.org:443
+    netbirdAPI:
+      keyFromSecret:
+        key: NB_API_KEY
+        name: netbird-mgmt-api-key
+