feat(chart): add optional NetworkPolicy for high availability - #486
DsThakurRawat wants to merge 1 commit into
Conversation
kubernetes-prow
Bot
added
the
do-not-merge/invalid-commit-message
✅ Deploy Preview for node-readiness-controller canceled.
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: DsThakurRawat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
✅ Deploy Preview for node-readiness-controller canceled.
|
kubernetes-prow
Bot
added
the
needs-ok-to-test
|
Hi @DsThakurRawat. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
kubernetes-prow
Bot
added
cncf-cla: yes
Adds a networkPolicy section to values.yaml that templates into a NetworkPolicy resource, disabled by default. When enabled it allows kubelet probes, the webhook and metrics ports when those servers are on, plus API server and DNS egress, with extra ingress/egress rules appendable verbatim. Covered by helm-unittest like the other templates. Signed-off-by: Divyansh Rawat <divyanshrawatofficial@gmail.com>
5c7ebff to
18af0d7
Compare
kubernetes-prow
Bot
removed
the
do-not-merge/invalid-commit-message
|
waiting for feedback on this one |
1 participant
Adds an optional NetworkPolicy to the Helm chart, disabled by default.
When
networkPolicy.enabledis true, the policy selects the controller pods and allows kubelet probes (8081), the webhook port whenwebhook.enabled, the metrics port whenmetrics.enabled, plus API server (443) and DNS (53) egress. Extra ingress/egress rules can be appended verbatim via values for clusters that need more.Verified locally:
helm lintclean,helm templaterenders byte-identical output across runs, the podSelector matches the deployment selector exactly, all 46 helm-unittest tests pass (5 new), andhack/verify-chart-drift.shis clean.Fixes #480