feat(netbird)!: controller-agnostic ingressGrpc annotations; bump netbird 0.77.1, keycloak 26.7.2

[mikkeldamsgaard]

Folds in every open issue: the 21 autorelease upstream bumps plus the ingressGrpc annotations report.

1. Fix #134 — nginx-specific annotations were applied to every controller

server.ingressGrpc.annotations shipped four nginx.ingress.kubernetes.io/* keys by default, but server.ingressGrpc.className is configurable — so HAProxy/Traefik users got irrelevant nginx annotations on their Ingress. Annotations now default to {}, with the nginx set kept in values.yaml as a commented example.

One addition beyond the issue's suggestion. The issue notes "no template changes should be required", which is true for rendering — but dropping the defaults outright would silently break existing ingress-nginx users, since without backend-protocol: GRPC the controller proxies the backend as HTTP/1.1 and gRPC fails with no obvious error. So the chart now fails at template time when className contains nginx and that annotation is missing, printing the exact block to add. This mirrors the existing fail-fast guard for ingressGrpc without TLS. Non-nginx controllers need no annotations and are unaffected.

⚠️ User-visible behavior change — migration steps are in CHANGELOG.md.

2. Upstream version bumps

Chart	appVersion	Notes
netbird	0.73.2 → 0.77.1	Covers 0.74.x–0.77.x. Agent Network, rewritten desktop client, relay X-Real-Ip restricted to trusted proxies, privileged-caller checks for local SSH settings. No config key, env var, port, or protocol used by this chart changed; no manual DB migration.
netbird dashboard	v2.39.0 → v2.91.0	Pairs with server 0.77.x. Verified the env contract is unchanged — every variable the chart sets is still rendered by upstream's own dashboard.env.
keycloak	26.6.3 → 26.7.2	Fixes CVE-2026-59888/59889 (jackson-databind) and CVE-2026-9796 (admin role rename TOCTOU → realm-wide escalation). Goes straight to .2 because 26.7.2 fixes an upgrade failure in the stateless cluster provider. No KC_* option used here changed; the options removed in 26.7.0 (persistent-session batching, token-exchange-external-internal:v2) are not used by this chart.

3. Drive-by: drop deprecated Keycloak admin env vars

The e2e surfaced KC-SERVICES0110 on every Keycloak start — the chart was still using KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD, deprecated upstream in favour of KC_BOOTSTRAP_ADMIN_USERNAME / KC_BOOTSTRAP_ADMIN_PASSWORD. Switched. No values change — admin.username and admin.password are untouched; only the emitted env var names differ. Called out separately here in case you'd rather split it out.

Closes #115, #116, #117, #118, #119, #120, #121, #122, #123, #124, #125, #126, #127, #128, #129, #130, #131, #132, #133, #134, #135

How to verify

make test      # lint + 376 helm-unittest tests — passing locally
dprint check   # clean
make e2e       # all 9 scenarios passed locally (exit 0, zero failures)

New unit tests cover: no annotations by default, user-supplied nginx annotations rendered verbatim, a non-nginx controller with its own annotations, the nginx guard firing, annotations: null producing the actionable error rather than a type error, and non-nginx classNames passing without annotations.

The keycloak e2e was re-run after the KC_BOOTSTRAP_ADMIN_* switch so all three scenarios exercise the final template.

🤖 Generated with Claude Code

[mikkeldamsgaard]

Heads-up on an unrelated CI breakage this PR also had to fix.

Format Check was failing for every PR, not just this one. The job ran go install github.com/digitalstudium/helmfmt@latest, and helmfmt v0.6.1 — published after main's last green run in June — doesn't build:

format.go:54:34: undefined: sprigStubNames

Reproduced locally. Pinned to v0.6.0, the newest version that builds (per the repo's own "pinned versions, no download-latest-at-build-time" rule).

v0.6.0 indents template control flow differently from the v0.6.1 output currently committed, so the pin also reapplies formatting across 15 templates. That's whitespace only — I verified helm template output is byte-identical before and after for default values, netbird with Gateway API routes enabled, and keycloak with admin credentials + 2 replicas (ignoring the auto-generated secrets that are randomised on every render by design). It's in its own commit (1b3fbbe) so the functional changes stay reviewable.

If you'd rather track helmfmt's newer style, the alternative is waiting for an upstream fix to v0.6.1+ and pinning that instead — happy to swap.