Stuck figuring out how to expose a Kubernetes Service internally using NetBird Operator.

[Archisman-Mridha]

I have a Hetzner Network with CIDR 10.0.0.0/16. And a workload cluster is running inside that private network. The cluster has default Kubernetes Service CIDR :

kubectl get servicecidr
NAME         CIDRS          AGE
kubernetes   10.96.0.0/12   7d9h

I have deployed NetBird Operator in that workload cluster, with the following Helm values :

managementURL: "...."

netbirdAPI:
  keyFromSecret:
    name: "netbird-management-api-key"
    key: "NB_API_KEY"

cluster:
  name: qa-cluster

ingress:
  enabled: true

  # Allow creating policies through Service annotations
  allowAutomaticPolicyCreation: true

  # Kubernetes services is a common way to route traffic to your application pods. With the NetBird
  # operator ingress you can expose services to your NetBird network as resources by using
  # annotations in your services. The operator will create networks, resources, and add routing
  # peers to your NetBird configuration.
  router:
    enabled: true

    tolerations:
      - operator: Exists
        key: node-role.kubernetes.io/control-plane
    nodeSelector:
      node-role.kubernetes.io/control-plane: ""

# To access your Kubernetes control plane from a NetBird network, you can expose your Kubernetes
# control plane as a NetBird resource.
kubernetesAPI:
  enabled: true

operator:
  tolerations:
    - operator: Exists
      key: node-role.kubernetes.io/control-plane
  nodeSelector:
    node-role.kubernetes.io/control-plane: ""

webhook:
  failurePolicy: Ignore

Now, I have deployed NGINX. Here is the Kubernetes Service for that NGINX deployment :

apiVersion: v1
kind: Service
metadata:
  annotations:
    netbird.io/expose: "true"
    netbird.io/policy: default
    netbird.io/resource-name: nginx
    netbird.io/policy-source-groups: Obmondo
    netbird.io/groups: QA cluster nodes
  labels:
    app: nginx
  name: nginx
  namespace: netbird
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: nginx
  type: ClusterIP

I can see that the NetBird Operator has created the nginx resource in the qa-cluster network in NetBird :

In my machine :

netbird networks list
Available Networks:

  - ID: nginx
    Domains: nginx.netbird.svc.cluster.local
    Status: Not Selected
    Resolved IPs: -

  - ID: qa-cluster
    Network: 10.0.0.0/16
    Status: Selected

If I do dig +short nginx.netbird.svc.cluster.local, it doesn't resolve to any IP.

Now, if I disconnect from the qa-cluster network and connect to nginx network, dig +short nginx.netbird.svc.cluster.local resolves to 10.107.184.110 : which is the IP of the Kubernetes Service corresponding to the NGINX deployment. But ofcourse, it's not reachable from my local machine, since I have disconnected from the qa-cluster network.

I need some help with how to expose this NGINX deployment internally using the NetBird Operator 🙏.

[Archisman-Mridha]

• I have went through and followed everything specified here : https://github.com/netbirdio/kubernetes-operator/blob/main/docs/usage.md.

• The NetBird Operator is running in a separate VPN cluster in the same Hetzner Network.

[bornav]

not really a solution, but as i also faced similar issues and gave up id say wait for this to be implemented and released #172

[Archisman-Mridha]

Update :

I followed what my co-worker suggested and removed the netbird.io/resource-name: nginx annotation. Now, I can resolve nginx.netbird.svc.cluster.local while keeping the qa-cluster NetBird Network selected.

It resolves to the IP of the NGINX Kubernetes Service IP as before. But, i'm still not able to reach the NGINX Kubernetes Service IP from my local machine.

[turnalfred]

I have the same problem here the Service IP is being resolved but that IP is not reachable from my local machine connected to the netbird network

I'm stuck on what to do now but I was looking thru the guide here https://netbird.io/knowledge-hub/using-netbird-for-kubernetes-access and noticed that security Context Capabilities generated by the Operator has some missing capabilities

                - NET_RESOURCE
                - SYS_ADMIN

I dunno if those can be added or if they are the reason why the route is not working??

[phillebaba]

This is being fixed in #172. Aiming to have a release done this week along with updated documentation.

[Archisman-Mridha]

@turnalfred good catch.

I see that the NetBird Agent DaemonSet has those 2 capabilties :

                - NET_RESOURCE
                - SYS_ADMIN

but not the Routers being managed by the NetBird Operator. And when I try to patch the Router Deployment, those changes are immediately reverted by the NetBird Operator.

[Archisman-Mridha]

This is being fixed in #172. Aiming to have a release done this week along with updated documentation.

@phillebaba any updates on the release? Let me know if I can help in any way....

[phillebaba]

The release is now done, checkout v0.3.1 😄

Checkout the docs.
https://github.com/netbirdio/kubernetes-operator/blob/main/docs/getting-started.md
https://github.com/netbirdio/kubernetes-operator/blob/main/docs/api-reference.md

[phillebaba]

@Archisman-Mridha closing this issue as this relates to the old resources and the new ones should address your problems.

[Archisman-Mridha]

Hm, seems like container images for the new releases aren't published.

[phillebaba]

The image for the operator is here.

https://hub.docker.com/layers/netbirdio/kubernetes-operator/0.3.1/images/sha256-e1eace568fcd08f93dba23bf19c4b7c2038cd1ebc6344c60d214aece0169a34d

Is there something else that you are missing?

[Archisman-Mridha]

A my bad. It's without v.

[Archisman-Mridha]

2026-04-30T09:32:28Z    ERROR    setup    Failed to create controller    {"controller": "NetworkResource", "error":
"unable to retrieve the complete list of server APIs: netbird.io/v1alpha1: no matches for netbird.io/v1alpha1, Resou
rce="}
main.main
    /workspace/cmd/main.go:317
runtime.main
    /usr/local/go/src/runtime/proc.go:290

It's currently logging this error. I'm trying to understand why this is happening.

[Archisman-Mridha]

I see the CRDs are under the netbird.io/v1 group. But in the examples, you guys have refactored to netbird.io/v1alpha1.