cattleset: add networkPolicy.flavor with cilium support#497
Merged
Conversation
Mirror #474 for the cattleset chart. Adds a networkPolicy.flavor value (default kubernetes) and helper functions (security.networkPolicyFlavor, security.useCiliumNetworkPolicy, security.useKubernetesNetworkPolicy) that read both the chart-local value and the global namespaced value so the toggle propagates when cattleset is pulled in as a subchart. When flavor=cilium and networkPolicy.enabled=true, cattleset emits CiliumNetworkPolicy resources: ingress from kube-apiserver on 9443 for the conversion/mutation/validation webhooks, egress to kube-apiserver on 6443, and DNS egress. Otherwise the default networking.k8s.io/v1 NetworkPolicy resources are emitted as before. Signed-off-by: Tamal Saha <tamal@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirrors #474 (
networkPolicy.flavorwith cilium support) for thecattlesetchart. Adds anetworkPolicy.flavorhelm value (defaultkubernetes) plus the helper layer (security.networkPolicyFlavor,security.useCiliumNetworkPolicy,security.useKubernetesNetworkPolicy) that reads both the chart-local value and the global namespaced value, so the toggle propagates when cattleset is pulled in as a subchart.When
flavor=ciliumandnetworkPolicy.enabled=true, cattleset emitsCiliumNetworkPolicyresources:kube-apiserveron9443— conversion / mutation / validation webhookskube-apiserveron6443kube-dnson53Otherwise the default
networking.k8s.io/v1NetworkPolicy resources are emitted, unchanged.The
values.openapiv3_schema.yamlalready carriedflavor— cattleset was added (#495) after #474 merged, so the sharedNetworkPolicySpec.Flavortype was already in the generated schema. Noapis/or codegen changes were needed.Test plan
helm template cs ./charts/cattleset— no policies (default)helm template cs ./charts/cattleset --set networkPolicy.enabled=true— 2NetworkPolicy(current behavior preserved)helm template cs ./charts/cattleset --set networkPolicy.enabled=true --set networkPolicy.flavor=cilium— 3CiliumNetworkPolicy--set networkPolicy.enabled=true --set global.networkPolicy.flavor=cilium— flavor propagates (global → local fallback)helm lint ./charts/cattlesetRelated