NetBird Agent Network on managed Kubernetes

This Green package configures a NetBird gateway and a two-pod application. The NetBird client runs in netstack/SOCKS5 mode without TUN or capabilities. The isolated agent runs Claude Code. Its NetworkPolicy permits only the SOCKS5 listener, with no DNS or ServiceAccount token. Acceptance tests direct egress and connections through SOCKS5, and verifies tunnel identity, model restrictions, budget limits, and access-log attribution.

Use one colors.yml for non-secret desired state. The hostname and its wildcard must be free in the Cloudflare zone. Read configuration for application settings and credentials. Never export COLORS_PAR_PROFILE.