SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-11 10:41:45 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Support having tags for peers for more dynamic NetworkRoutes #572

New Issue
Closed
opened 2025-11-20 05:14:00 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 05:14:00 -05:00
Owner
Copy Link

Originally created by @ArjonBu on GitHub (Jan 7, 2024).

Is your feature request related to a problem? Please describe.
Let’s say I have a k8s pod as an agent which connects to the Netbird server. Sometimes it happens that the pod is killed and then when it connects again with the setup key, it will create a new peer with the same hostname.

The problem I have with this is in case I setup NetworkRoutes with this peer, then the network route will not work because I have duplicate peers with the same name (although only one is offline).

Workaround to this:

  1. Create a setup key for each peer which assigns the peer to 2 groups: "peer1" and "dev-clusters"
  2. Setup ACLs for "dev-clusters" (so, I wouldn't need to do this for each peer group)
  3. Setup NetworkRoutes to use a peer group instead of a single peer.

The problem here is that this doesn't scale very well because you need to create a setup key for each peer/k8s cluster.

Describe the solution you'd like
I would like to use tags for peers just like Gitlab uses its runners for jobs.
When connecting a peer, I want the option to assign tags and then when setting up NetworkRoutes, I can use tags instead of using groups. This will make it easier because I can use groups for ACLs and tags for NetworkRoutes.
Groups are more static which I think would be more appropriate to manage user peers only, while tags are more appropriate for dynamic workloads peers like bastion hosts, etc.

Additional context
Another solution would be to allow a setup key to have many groups assigned (or use regex) and then a parameter to netbird cli to set the specific group. This would eliminate the need for many setup keys, but might be a hassle to manage because you might need to update it frequently depending on the new peers (remember that each peer needs a group).

Originally created by @ArjonBu on GitHub (Jan 7, 2024). **Is your feature request related to a problem? Please describe.** Let’s say I have a k8s pod as an agent which connects to the Netbird server. Sometimes it happens that the pod is killed and then when it connects again with the setup key, it will create a new peer with the same hostname. The problem I have with this is in case I setup NetworkRoutes with this peer, then the network route will not work because I have duplicate peers with the same name (although only one is offline). Workaround to this: 1. Create a setup key for each peer which assigns the peer to 2 groups: "peer1" and "dev-clusters" 2. Setup ACLs for "dev-clusters" (so, I wouldn't need to do this for each peer group) 3. Setup NetworkRoutes to use a peer group instead of a single peer. The problem here is that this doesn't scale very well because you need to create a setup key for each peer/k8s cluster. **Describe the solution you'd like** I would like to use tags for peers just like Gitlab uses its runners for jobs. When connecting a peer, I want the option to assign tags and then when setting up NetworkRoutes, I can use tags instead of using groups. This will make it easier because I can use groups for ACLs and tags for NetworkRoutes. Groups are more static which I think would be more appropriate to manage user peers only, while tags are more appropriate for dynamic workloads peers like bastion hosts, etc. **Additional context** Another solution would be to allow a setup key to have many groups assigned (or use regex) and then a parameter to netbird cli to set the specific group. This would eliminate the need for many setup keys, but might be a hassle to manage because you might need to update it frequently depending on the new peers (remember that each peer needs a group).
saavagebueno added the feature-requestquestion labels 2025-11-20 05:14:00 -05:00
saavagebueno commented 2025-11-20 05:14:01 -05:00
Author
Owner
Copy Link

@werlitong commented on GitHub (Jan 8, 2024):

Hello! Did you tried the Ephemeral peers setting? It's under Create Setup key screen.

image

The only "problem" it is the removal time of 10min. But this perhaps (in a future) can be adjustable @mlsmaycon, right?

@werlitong commented on GitHub (Jan 8, 2024): Hello! Did you tried the Ephemeral peers setting? It's under Create Setup key screen. ![image](https://github.com/netbirdio/netbird/assets/10401181/9e74ea41-7308-49cd-84e1-99f1ff2ea55c) The only "problem" it is the removal time of 10min. But this perhaps (in a future) can be adjustable @mlsmaycon, right?
saavagebueno commented 2025-11-20 05:14:01 -05:00
Author
Owner
Copy Link

@ArjonBu commented on GitHub (Jan 8, 2024):

@werlitong if a peer goes offline for longer than 10 minutes, what happens in the NetworkRoutes if this peer is assigned to the route? Will the config go away?

What happens if the peer comes back (as new) later? Will the NetworkRoute work out of the box?

@ArjonBu commented on GitHub (Jan 8, 2024): @werlitong if a peer goes offline for longer than 10 minutes, what happens in the NetworkRoutes if this peer is assigned to the route? Will the config go away? What happens if the peer comes back (as new) later? Will the NetworkRoute work out of the box?
saavagebueno commented 2025-11-20 05:14:02 -05:00
Author
Owner
Copy Link

@werlitong commented on GitHub (Jan 9, 2024):

@werlitong if a peer goes offline for longer than 10 minutes, what happens in the NetworkRoutes if this peer is assigned to the route? Will the config go away?

What happens if the peer comes back (as new) later? Will the NetworkRoute work out of the box?

i did not test this yet, can't confirm.

@werlitong commented on GitHub (Jan 9, 2024): > @werlitong if a peer goes offline for longer than 10 minutes, what happens in the NetworkRoutes if this peer is assigned to the route? Will the config go away? > > What happens if the peer comes back (as new) later? Will the NetworkRoute work out of the box? i did not test this yet, can't confirm.
saavagebueno commented 2025-11-20 05:14:02 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 17, 2025):

I do believe the use cases presented here are covered by Ephemeral Peers. I am closing this, considering the new Networks feature is set to replace Network Routes completely.

Feel free to keep the discussion going to reopen if you think otherwise.

@nazarewk commented on GitHub (Apr 17, 2025): I do believe the use cases presented here are covered by Ephemeral Peers. I am closing this, considering the new Networks feature is set to replace Network Routes completely. Feel free to keep the discussion going to reopen if you think otherwise.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#572
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?