NetBird Pulumi Provider

A Pulumi provider for managing resources in NetBird.

This provider is built on top of the NetBird Terraform Provider using the Pulumi Terraform Bridge.

Supported Languages

The following SDKs are available and automatically updated:

• NodeJS (@kitstream/netbird-pulumi on npm)
• Python (pulumi_netbird on PyPI)
• Go (github.com/KitStream/netbird-pulumi-provider/sdk/go/index)
• .NET (KitStream.Pulumi.Netbird on NuGet)
• Java (io.github.kitstream:netbird on Maven Central)

Installation

To use this provider, install the appropriate SDK for your language. For example:

NodeJS

npm install @kitstream/netbird-pulumi

Python

pip install pulumi_netbird

Go

go get github.com/KitStream/netbird-pulumi-provider/sdk/go/index

.NET

dotnet add package KitStream.Pulumi.Netbird

Java

Gradle:

implementation("io.github.kitstream:netbird:0.0.1")

Maven:

<dependency>
    <groupId>io.github.kitstream</groupId>
    <artifactId>netbird</artifactId>
    <version>0.0.1</version>
</dependency>

Configuration

The provider requires the following configuration settings:

Variable	Description	Environment Variable
token	Admin PAT for NetBird Management Server	NB_PAT
managementUrl	NetBird Management API URL	NB_MANAGEMENT_URL
tenantAccount	Account ID to impersonate	NB_ACCOUNT

You can set these using pulumi config set:

pulumi config set netbird:token YOUR_PAT --secret
pulumi config set netbird:managementUrl https://api.netbird.io

Local Development

The upstream/ directory is a git submodule pointing at the NetBird Terraform Provider. After cloning the repo, initialise it and apply local patches:

git submodule update --init
./setup_upstream.sh

setup_upstream.sh does two things that are needed for the Pulumi bridge:

1. Generates a thin shim file at upstream/shim/provider/shim.go that re-exports internal/provider.New. Go's internal visibility rule prevents the bridge from importing the package directly, so the shim must live inside upstream/.
2. Applies test-data patches (upstream.patch) required by the integration tests. Without these the management server fails to start (wrong encryption key format, duplicate peer keys, etc.).

The submodule is configured with ignore = dirty in .gitmodules, so these working-tree modifications will never make the parent repo appear dirty.

Documentation

For more information on the available resources and data sources, see the Pulumi Registry. (TBD)

Releasing

For instructions on how to release new versions of this provider, see RELEASING.md.