Can't create resources manual over crds

[KaiBroeker]

Hi,

I want to automate some netbird creations the k8s native way and want to avoid to use terraform.
I can created groups over the crds with no problems, but if I try to create policies, some errors comes:

apiVersion: netbird.io/v1
kind: NBPolicy
metadata:
  labels:
    app.kubernetes.io/component: operator
    app.kubernetes.io/instance: netbird-operator
    app.kubernetes.io/name: kubernetes-operator
  name: client-to-k8s-staging
spec:
  bidirectional: false
  name: client-to-k8s-staging
  sourceGroups:
    - staging-clients
  destinationGroups:
    - k8s-staging
  protocols:
    - tcp
  ports:
    - 443
    - 8080

The "error":

 2025-09-25T12:00:58Z    INFO    NBPolicy    Reconciling NBPolicy    {"namespace": "", "name": "client-to-k8s-staging │
│ "}                                                                                                                   │
│ 2025-09-25T12:00:58Z    INFO    NBPolicy    0 ports found for protocol in policy    {"namespace": "", "name": "clien │
│ t-to-k8s-staging", "protocol": "tcp"} 

My expectations is, that I can create policies lke groups and like in terraform.
What is the benefit? I only have to use k8s, also in a mixed envirement.

[KaiBroeker]

Looking into the code: seams that nbPolicy depends on nbResource. In my opinion it should also work without any other crds.

func (r *NBPolicyReconciler) mapResources(ctx context.Context, nbPolicy *netbirdiov1.NBPolicy, resources []netbirdiov1.NBResource, logger logr.Logger) (map[string][]int32, []string, error) {
	portMapping := map[string]map[int32]interface{}{
		protocolTCP: make(map[int32]interface{}),
		protocolUDP: make(map[int32]interface{}),
	}
	groups, err := r.groupNamesToIDs(ctx, nbPolicy.Spec.DestinationGroups, logger)
	if err != nil {
		return nil, nil, err
	}

	for _, resource := range resources {

[mohamed-essam]

Hi @KaiBroeker ,
This is done to ensure policies aren't created when unneeded, since currently only NBResource actually integrates with the policies.
This is also done to be able to control TCP vs UDP access, instead of allowing all protocols.
Another point is that NBPolicy here aggregates the needed ports automatically from all NBResources (instead of the user having to manually define all ports), and the ports/protocols part in the policy definition is more of a constraint than a definition.