GRPCRoute example missing management.ProxyService rule, breaks reverse-proxy support

[christianhuth]

What's missing

charts/netbird/values.yaml documents the example for server.grpcRoute.rules as:

# - matches:
#     - method: { service: signalexchange.SignalExchange }
#     - method: { service: management.ManagementService }

and the accompanying comment describes the route as being "for gRPC routes (signal + management)".

This is missing a third gRPC service, management.ProxyService, which is required specifically for connecting a self-hosted NetBird reverse proxy to this management server. Following the documented example as-is (as I did) results in a GRPCRoute that works fine for regular NetBird clients but breaks the reverse proxy.

Symptom

With only the two documented rules in place, the reverse proxy's pod never becomes Ready, and its logs repeat:

management connection failed, retrying in ...: mapping stream: receive msg: rpc error: code = Unimplemented desc =

That empty-description Unimplemented is the Gateway controller (Envoy, in my case Cilium's Gateway implementation) rejecting a gRPC method it has no route for - the management server itself does implement management.ProxyService (verified via the netbird-management binary), it's just unreachable through a GRPCRoute that wasn't written with it in mind.

Fix

Adding a third rule for management.ProxyService, routed to the same backend, resolves it immediately:

server:
  grpcRoute:
    enabled: true
    rules:
      - matches:
          - method: { service: signalexchange.SignalExchange }
      - matches:
          - method: { service: management.ManagementService }
      - matches:
          - method: { service: management.ProxyService }