ccbash/netbird-operator

This project is a Kubernetes operator, a piece of automation that runs inside a Kubernetes cluster and manages other resources for you, for a private networking tool called NetBird. NetBird creates a private overlay network, sometimes called a mesh, that lets devices and services talk to each other securely without needing to be exposed to the public internet. This operator lets you put your Kubernetes services onto that private NetBird network just by describing what you want in configuration files, with DNS names handled automatically. It started as a fork of the official NetBird Kubernetes operator but has been rebuilt enough that it behaves quite differently. Instead of a few broad, all-in-one configuration objects, it mirrors NetBird's own concepts closely with objects like Network, DNSZone, DNSRecord, and Group, each kept in sync with NetBird continuously. It also specifically routes traffic to a service's LoadBalancer address rather than its internal ClusterIP address, because ClusterIPs tend to collide when working across multiple clusters while LoadBalancer addresses do not. There are two main ways to expose a service with this tool. The first is to advertise a service's LoadBalancer address directly onto the NetBird mesh, along with a matching DNS name, so it becomes reachable to other devices on that private network. The second is to have the operator deploy and manage its own NetBird reverse proxy inside the cluster, which can front web traffic using Kubernetes' Gateway API and handle things like HTTPS certificates, without giving every individual app its own routable address. Both approaches keep services private to the mesh by default rather than exposing them to the public internet, though a reverse proxy can be configured to accept public traffic if that is what you want. To install it, you create a Kubernetes namespace, store a NetBird management API key as a secret, and install the tool using Helm, a package manager for Kubernetes. From there, further behavior such as which NetBird network to advertise into, which DNS zone to use, and whether to enable the Gateway API integration is configured through Helm values and a small number of custom resource files.