Merged
Conversation
Add Personal Access Token (PAT) seeding capability to the NetBird Helm chart using Initium v1.0.1. When pat.enabled=true, a post-install/post-upgrade Job seeds a service user account and PAT into the database. Features: - New pat-seed-job.yaml: Helm hook Job that waits for the server and seeds PAT - New pat-seed-configmap.yaml: Initium seed specification - Supports all three database backends: SQLite, PostgreSQL, MySQL - Security contexts: root for SQLite (PVC access), non-root for external DBs - ConfigMap uses MiniJinja templates for sensitive token injection via env vars - Comprehensive unit tests (configmap and job) with 148 total tests passing Configuration (values.yaml): - pat.enabled: Enable/disable PAT seeding - pat.accountId/userId: IDs for the seeded account and service user - pat.name: PAT display name - pat.expirationDays: Token validity period (default 365 days) - pat.secret.secretName: K8s Secret containing the PAT token and hash E2E testing: - Updated e2e.sh with proper PAT token generation (nbp_ + 30-char secret + base62 CRC32 checksum) and curl-based authentication verification - All three backends (sqlite, postgres, mysql) tested and passing Dependencies: - Upgraded Initium to v1.0.1 (fixes PostgreSQL insert_row for text PKs) - Boolean values use 1/0 for MySQL tinyint compatibility - Datetime format uses space separator for MySQL compatibility
The PAT seed Job cannot mount a ReadWriteOnce PVC that is already attached to the server pod. Replace the Job with a Kubernetes native sidecar (init container with restartPolicy: Always, K8s 1.28+) that shares the data volume inside the same pod. Changes: - server-deployment.yaml: add pat-seed native sidecar with --sidecar flag (Initium v1.0.4) to stay alive after seeding, maintaining full pod readiness (2/2 Running) - pat-seed-job.yaml: only render for external databases (PostgreSQL/MySQL) - pat-seed-configmap.yaml: regular resource for SQLite (needed by Deployment), Helm hook for external DBs (needed by hook Job) - _helpers.tpl: remove gob-encoded network_* columns from accounts seed to prevent migratePreAuto decode errors on server restart - values.yaml: bump Initium from v1.0.1 to v1.0.4 - e2e.sh: check sidecar logs for completion instead of container termination (sidecar stays alive with --sidecar flag) - 167 unit tests passing, SQLite e2e test passing with PAT auth Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mikkeldamsgaard
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Add Personal Access Token (PAT) seeding capability to the NetBird Helm chart using Initium v1.0.4. Enables immediate API access without manual token creation — useful for automation, CI/CD, and GitOps workflows.
Key Features
PAT Seeding Mechanism
restartPolicy: Always, K8s 1.28+) in the server Deployment--sidecarflag to stay alive after seeding2/2 Runningwhen healthySeed Behavior
accounts,users, andpersonal_access_tokenstables (via GORM AutoMigrate)Configuration (values.yaml)
pat.enabled: Enable/disable PAT seedingpat.secret.secretName: K8s Secret containing plaintext PAT and base64 SHA256 hashpat.name,pat.userId,pat.accountId: Configurable identifierspat.expirationDays: Token validity period (default 365)Changes
pat-seed-configmap.yaml,pat-seed-job.yamlserver-deployment.yamlwith native sidecar support_helpers.tplwith PAT seed spec generationci/scripts/e2e.shwith PAT generation and authentication verification--sidecarflag, text PK fixes)Breaking Changes
None. PAT seeding is opt-in (
pat.enabled: falseby default).Testing
curl -H "Authorization: Token nbp_..." https://netbird.example.com/api/groupsverifiedCloses #3