Feature/k8s auth proxy#91
Conversation
This adds a Kubernetes API authentication proxy that: - Embeds the NetBird client to join the mesh network - Authenticates incoming requests using WhoIs peer identity lookup - Maps NetBird user/groups to Kubernetes impersonation headers - Provides identity-aware RBAC for kubectl access through NetBird New files: - cmd/auth-proxy/main.go: Auth proxy binary with embedded NetBird client - Dockerfile.auth-proxy: Multi-arch container build - helm/kubernetes-operator/templates/auth-proxy-*.yaml: Helm templates Configuration (values.yaml): - authProxy.enabled: Enable/disable the auth proxy - authProxy.setupKey: NetBird setup key for the proxy peer - authProxy.hostname: Peer hostname in NetBird network - authProxy.dnsDomain: NetBird DNS domain for TLS cert generation - authProxy.managementURL: NetBird management server URL RBAC: - ClusterRole with impersonate permissions for users, groups, serviceaccounts - Dedicated ServiceAccount for the auth proxy Requires: netbird with client/embed package support
shyam0904a
force-pushed
the
feature/k8s-auth-proxy
branch
from
5ed5a4f to
acf7f61
Compare
|
This seems like a feature we'd love, love, love to use! Any idea when it might be merged & released? |
|
@shyam0904a thank you for the contribution, I am sorry that it has taken so long but we have had to focus on getting other issues fixed first. I think this feature would be very useful. I am just considering if it is better to keep this in its own repository instead of in the operator. I am also looking at getting tighter integrations with Netbird to get more explicit support for Kubernetes clusters. |
Would love to have this feature on netbird soon :)
sounds good, happy to sync on this and collaborate. |
5 participants
Description
Add Kubernetes API Auth Proxy feature that provides identity-aware access to the Kubernetes API through NetBird.
New files:
cmd/auth-proxy/main.go: Auth proxy binary with embedded NetBird clientDockerfile.auth-proxy: Multi-arch container buildhelm/kubernetes-operator/templates/auth-proxy-*.yaml: Helm templates for deployment, RBAC, and secretConfiguration (values.yaml):
authProxy.enabled: Enable/disable the auth proxyauthProxy.setupKey: NetBird setup key for the proxy peerauthProxy.hostname: Peer hostname in NetBird networkauthProxy.dnsDomain: NetBird DNS domain for TLS certauthProxy.managementURL: NetBird management server URLRequires: netbird with
client/embedpackage support