netbird

func APIKey ¶

func APIKey() string

APIKey returns secrets.yaml's netbird.apiKey. Nil-safe — the netbird block is optional and absent on most workload-cluster secrets files.

func AwaitOperatorToken ¶

func AwaitOperatorToken(
	ctx context.Context,
	clusterClient client.Client,
	keycloakAdminPassword string,
) (proceedWithLockdown bool, err error)

AwaitOperatorToken settles the netbird-mgmt-api-key Secret before lockdown: without it the operator's Pod webhook (failurePolicy: Fail) blocks every Pod create. When the Secret is missing and stdin is a terminal the operator chooses paste-now / wait / defer; without a terminal it polls then fails (CI expects the Secret via secrets.yaml).

Returns proceedWithLockdown=false when the operator defers — the caller must then skip lockdown and the LB public-interface disable, or they'd lose kube-apiserver with no mesh path back. keycloakAdminPassword feeds the "create your Keycloak login first" box (NetBird login is Keycloak SSO). No-op when the cluster doesn't host the operator.

func ClusterProxyEnabled ¶

func ClusterProxyEnabled() bool

ClusterProxyEnabled reports whether the netbird-operator clusterProxy block is configured and enabled. Nil-safe.

func ManagementURL ¶

func ManagementURL() string

ManagementURL returns the NetBird Mgmt endpoint from cluster.netbird.dns, or "" when unset — the values overlay then omits managementURL (the operator binary would fall back to NetBird Cloud) and the API-key gate's instructions cover wiring it manually.

func OperatorEnabled ¶

func OperatorEnabled() bool

OperatorEnabled reports whether to render the netbird-operator ArgoCD app: every VPN cluster (it hosts Mgmt; the operator's CRDs declare routing-peer and exposed-service wiring), and workload clusters that join a mesh (cluster.netbird.dns set — the NetBird Management endpoint).

func WaitAndPatchPostgresDSN ¶

func WaitAndPatchPostgresDSN(ctx context.Context, clusterClient client.Client) error

WaitAndPatchPostgresDSN polls until CNPG has created the netbird-pgsql-app Secret in the netbird namespace, then patches netbird's Secret with the DSN built from it.

Called from netbird's AfterSync hook so the patch happens with the rest of netbird's wiring rather than trailing as a separate post-sync step. The poll is necessary because netbird's ArgoCD sync returns as soon as the Cluster CR is applied — CNPG still has to reconcile that CR into running pods + the *-app Secret, a few seconds later.