fix(netbird-operator): pin image to v0.7.0 and drop ClusterProxy groups

Pin the operator image to v0.7.0 (operator.image.tag) — the ClusterProxy apiserver-proxy controller lives there. Drop the groups field from the ClusterProxy template + values: the vendored 0.6.0 CRD prunes it, leaving ArgoCD perpetually OutOfSync, and group scoping isn't needed (mesh policy + impersonation RBAC handle authorization).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ashish1099

argocd-helm-charts/netbird-operator/templates/cluster-proxy.yaml

@@ -5,7 +5,7 @@
      shared kubernetes Service ClusterIP (10.96.0.1, identical in every
      cluster). The chart also provisions the impersonation ServiceAccount +
      ClusterRole/Binding the proxy needs. Requires netbird-operator >= 0.7.0
-     (the apiserver-proxy controller and the ClusterProxy `groups` field).
+     (the apiserver-proxy controller).
 
      The proxy GRANTS nothing — it impersonates. Authorization still comes from
      your own RBAC bound to the NetBird users/groups the proxy stamps. */}}
@@ -52,10 +52,4 @@ spec:
   clusterName: {{ $name }}
   serviceAccountName: {{ $sa }}
   apiServer: {{ .Values.clusterProxy.apiServer }}
-  {{- with .Values.clusterProxy.groups }}
-  groups:
-    {{- range . }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
 {{- end }}

argocd-helm-charts/netbird-operator/values.yaml

@@ -1,4 +1,9 @@
 netbird-operator:
+  # Pin the operator image to 0.7.0 — the ClusterProxy apiserver-proxy
+  # controller lives there (the vendored 0.6.0 subchart/CRDs are otherwise fine).
+  operator:
+    image:
+      tag: "v0.7.0"
   webhook:
     # The operator ships a mutating webhook on EVERY pod CREATE in the
     # cluster (mpod-v1.netbird.io) to inject mesh sidecars/DNS. On
@@ -69,6 +74,3 @@ clusterProxy:
   # In-cluster apiserver URL — the default sidesteps cert-SAN/hostname issues
   # since the proxy never leaves the cluster network to reach the apiserver.
   apiServer: https://kubernetes.default.svc.cluster.local
-  # NetBird groups the proxy peer joins; grant access via a Mgmt policy
-  # targeting these. Needs operator >= 0.7.0. Empty = none.
-  groups: []