cleanup: remove headscale

.env.example

@@ -1,17 +1,11 @@
-# Nebula provider credentials — SECRETS (plus one per-cluster endpoint).
+# Nebula provider credentials — SECRETS.
 #
 # Copy to .env and fill in real values. .env is gitignored — never commit tokens.
 # Consumed by hack/deploy.sh (make deploy-all), which turns the credentials into one
 # Kubernetes Secret PER PROVIDER. Static non-secret config (image, namespace, Kind
 # cluster) is NOT here — pass it as make variables, e.g.
 #   make deploy-all IMG=myrepo/nebula:v1 DEPLOY_KIND_CLUSTER=nebula-test-e2e
 #
-# The lone non-secret that DOES belong here is SANDD_TUNNEL_SERVER (bottom): it is a
-# per-cluster value discovered at deploy time (the headscale NLB hostname), so keeping
-# it beside the deploy that consumes it — rather than a hand-passed make flag re-typed
-# every run — is the whole point. It rides the SAME parsed-not-sourced path as the
-# creds, so it can't leak into kubectl either.
-#
 #   cp .env.example .env
 #   # edit .env
 #   make deploy-all
@@ -44,22 +38,3 @@ AWS_SECRET_ACCESS_KEY=
 # --- Additional providers (add as adapters land) ---------------------------
 # Each provider gets its OWN secret (see hack/deploy.sh PROVIDER_SECRETS), e.g.:
 # RUNPOD_API_KEY=
-
-# --- SandD mesh endpoint (NON-SECRET, per-cluster) -------------------------
-# The internet-facing headscale NLB hostname the SandD mesh dials, as a bare
-# http://<host> (no port — the Service listens on 80; see config/sandd). It is only
-# known AFTER config/samples/headscale-service.yaml provisions and changes on every
-# recreate, so it can't live in the tracked manifests. deploy-all reads it from here
-# and `make deploy` substitutes the __SANDD_TUNNEL_SERVER__ token into headscale's
-# server_url and the nebula-sandd-config ConfigMap (byte-identical, as headscale
-# requires) — no re-typing across files, no manager restart.
-#
-# Read it back after applying the Service (README config/sandd step 1):
-#   kubectl apply -f config/samples/headscale-service.yaml
-#   HS=$(kubectl -n nebula-system get svc nebula-headscale \
-#     -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
-#   echo "SANDD_TUNNEL_SERVER=http://$HS"   # paste the result below, then make deploy-all
-#
-# Leave blank to skip SandD wiring — the token is then left in place (an obviously
-# broken render, surfaced by a deploy.sh warning), not a silent misconfig.
-SANDD_TUNNEL_SERVER=

Makefile

@@ -1,12 +1,6 @@
 # Image URL to use all building/pushing image targets
 IMG ?= inftyai/nebula-controller:latest
 
-# KEYBROKER_IMG is the SandD key-broker sidecar image (cmd/keybroker,
-# Dockerfile.keybroker) that runs alongside headscale — see config/sandd. Built and
-# pushed separately from the manager IMG because it is a distinct, optional image
-# with its own base (FROM headscale, so it carries the headscale CLI).
-KEYBROKER_IMG ?= inftyai/nebula-keybroker:latest
-
 # NAMESPACE is where the manager runs (must match config/manager). Consumed by
 # hack/deploy.sh via the deploy-all target.
 NAMESPACE ?= nebula-system
@@ -161,14 +155,6 @@ docker-build: ## Build docker image with the manager.
 docker-push: ## Push docker image with the manager.
 	$(CONTAINER_TOOL) push ${IMG}
 
-.PHONY: docker-build-keybroker
-docker-build-keybroker: ## Build docker image for the SandD key-broker sidecar.
-	$(CONTAINER_TOOL) build -f Dockerfile.keybroker -t ${KEYBROKER_IMG} .
-
-.PHONY: docker-push-keybroker
-docker-push-keybroker: ## Push the SandD key-broker sidecar image.
-	$(CONTAINER_TOOL) push ${KEYBROKER_IMG}
-
 # PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
 # architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
 # - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/
@@ -209,17 +195,7 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
 .PHONY: deploy
 deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
 	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
-	# SANDD_TUNNEL_SERVER is the internet-facing headscale NLB hostname, only known
-	# after that Service provisions and different on every recreate — so it can't be
-	# baked into the tracked manifests. The config/sandd overlay carries the literal
-	# token __SANDD_TUNNEL_SERVER__ in headscale's server_url and the nebula-sandd-config
-	# ConfigMap; substitute it here so both render correct on the FIRST apply (no
-	# manager/headscale restart). Driven from .env via deploy-all (make deploy-all),
-	# or pass SANDD_TUNNEL_SERVER=... directly. When unset the token is left as-is (the
-	# render is then obviously broken rather than silently pointing nowhere).
-	$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_FLAGS) config/default | \
-		$(if $(SANDD_TUNNEL_SERVER),sed 's|__SANDD_TUNNEL_SERVER__|$(SANDD_TUNNEL_SERVER)|g',cat) | \
-		$(KUBECTL) apply -f -
+	$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_FLAGS) config/default | $(KUBECTL) apply -f -
 
 .PHONY: deploy-e2e
 deploy-e2e: manifests kustomize ## Deploy for e2e: config/default plus the fake-provider env var (baked in at deploy time, not via a post-deploy rollout).

README.md

@@ -99,6 +99,4 @@ placement controller owns those.
 
 ## License
 
-Apache-2.0 — see [LICENSE](LICENSE). Third-party components (e.g. Tailscale, used by
-the optional SandD channel) are listed in
-[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+Apache-2.0 — see [LICENSE](LICENSE).