NetBird Agent Network on DigitalOcean Kubernetes

NetBird Agent Network on DigitalOcean Kubernetes An architecture diagram generated by Archify. Cloudflare DNS · base + wildcard A records · Architecture component Cloudflare DNS base + wildcard A records DigitalOcean LB · regional · TCP mode · Architecture component DigitalOcean LB regional · TCP mode Traefik · TLS ingress + passthrough · DigitalOcean · DOKS cluster › Gateway namespace Traefik TLS ingress + passthrough netbird-server · management · signal · relay · DigitalOcean · DOKS cluster › Gateway namespace netbird-server management · signal · relay NetBird Dashboard · agent-network-only mode · DigitalOcean · DOKS cluster › Gateway namespace NetBird Dashboard agent-network-only mode Server Datastore · CSI persistent volume · DigitalOcean · DOKS cluster › Gateway namespace Server Datastore CSI persistent volume NetBird Reverse Proxy · private endpoint gateway · DigitalOcean · DOKS cluster › Gateway namespace NetBird Reverse Proxy private endpoint gateway LLM Provider · upstream model API · Architecture component LLM Provider upstream model API DO Container Registry · created or adopted · Architecture component DO Container Registry created or adopted Kaniko Build · ephemeral write credential · DigitalOcean · DOKS cluster Kaniko Build ephemeral write credential NetBird Client Pod · netstack · SOCKS5 · no TUN · DigitalOcean · DOKS cluster › Restricted application namespace NetBird Client Pod netstack · SOCKS5 · no TUN Isolated Agent Pod · headless Claude Code · DigitalOcean · DOKS cluster › Restricted application namespace Isolated Agent Pod headless Claude Code A records TCP 80 / 443 HTTPS control plane HTTPS UI subdomain TLS passthrough persistent state SOCKS5 only NetBird overlay authenticated HTTPS push profile image read-only image pull DigitalOcean · DOKS cluster Gateway namespace Restricted application namespace Legend Frontend Backend Database Cloud Security External

Two Isolation Boundaries

  • • Kubernetes NetworkPolicy defaults the application namespace to deny
  • • The agent has no network interface path except localhost SOCKS5
  • • A first-converge Cilium canary proves enforcement before secrets enter the cluster

Keyless Model Access

  • • The agent reaches a policy-gated endpoint over the NetBird overlay
  • • Provider credentials terminate at the private reverse proxy, not in the agent pod
  • • The model provider receives authenticated HTTPS from the gateway

DigitalOcean Ownership

  • • OpenTofu owns the DOKS cluster and optionally the account-scoped registry
  • • The regional load balancer exposes only TCP 80 and 443 through Traefik
  • • Registry write credentials are ephemeral; workload pulls use a rotated read-only secret