jlab-cluster/helm-charts
3
0 Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Wiki Activity

feat(minecraft-server): networkPolicy.ingress.ambientMesh

Browse Source 
Gitea #143. Additive, default false, so the render is byte-identical to the
previous release - proven by diffing both renders against origin/main rather
than asserted.

Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying
the probe port, and - inside that rule's source-restricted branch -
169.254.7.127/32, the address the kubelet's probes arrive from once the pod is
in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the
port a pod whose namespace has joined the mesh is unreachable.

The two halves are one value because the second is the one nobody thinks of:
15008 added by hand leaves a policy that passes review and drops every probe
the first time probeSources is narrowed, and a pod that never becomes Ready
reads as a broken application rather than as a policy.

Minor, not major: additive value, unchanged default, unchanged render.

Port half only: this chart offers no networkPolicy.probeSources - its probes
put no packet on the network - so there is no redirected probe to allow and an
ipBlock for one would match nothing while making the rule look like it did
something. ci/run-networkpolicy-test.sh ties that exemption to the absence of
probeSources, not to a chart name.
This commit is contained in:
jklein committed 2026-10-19 17:56:58 +00:00
1 parent bc580ee291
commit 4a7ee1036c
4 files changed
+117 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

minecraft-server/templates/minecraft-server.networkpolicy.yaml
+69
View File
@@ -53,6 +53,11 @@ selects.
{{- $np := .Values.networkPolicy }}
{{- $ns := .Release.Namespace }}
{{- $allowedNs := $np.allowedNamespaces | default list }}
{{- /* networkPolicy.ingress - the policy's INBOUND side, and not the same
thing as the top-level .Values.ingress (the Ingress object) - both match
a search for "ingress". */}}
{{- $npIngress := $np.ingress | default dict }}
{{- $ambientMesh := $npIngress.ambientMesh }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
@@ -92,6 +97,38 @@ spec:
- ports:
- protocol: TCP
port: {{ .Values.server.port | int64 }}
{{- if $ambientMesh }}
{{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
HBONE tunnel, the port every inbound connection arrives on once the
namespace carries istio.io/dataplane-mode - ambient "does not and will
never bypass Kubernetes NetworkPolicy enforcement", so without it a pod
in the mesh is unreachable.
It is the one port here that is NOT a containerPort of the selected pod
spec: ztunnel terminates it, not the application. ci/run-networkpolicy-
test.sh holds a NAMED exception for exactly this number, gated on exactly
this value, and proves on a second render that it stays the only such
port and that it is absent while the value is false.
THE PORT HALF ONLY, and that is not an omission. Elsewhere this switch
also adds 169.254.7.127/32 as a probe source, because inside the mesh the
kubelet's probes are redirected away from the worker node's address.
This chart offers no networkPolicy.probeSources at all, so the rule
carrying the probe port is never restricted by source - and an
unrestricted rule needs no probe address. Measured in the render: three
exec probes, which put no packet on the network at all.
WHICH RULE IT JOINS:
the game-port rule, in BOTH of its branches. That rule is open when the
Service is a NodePort (players arrive from outside, already masqueraded)
and restricted to the namespace otherwise, and the two branches are
separate rules in this template - so the port is added twice, or it
would be missing from whichever branch a release happens to render.
NOT MEASURED: that 15008 alone suffices comes from Istio's
documentation. Measured on this cluster is only which listeners ztunnel
opens. Provable at the first namespace to join the mesh; none has. */}}
- protocol: TCP
port: 15008
{{- end }}
{{- end }}
{{- if not (eq .Values.server.service.type "NodePort") }}
{{- /*
@@ -107,6 +144,38 @@ spec:
- ports:
- protocol: TCP
port: {{ .Values.server.port | int64 }}
{{- if $ambientMesh }}
{{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
HBONE tunnel, the port every inbound connection arrives on once the
namespace carries istio.io/dataplane-mode - ambient "does not and will
never bypass Kubernetes NetworkPolicy enforcement", so without it a pod
in the mesh is unreachable.
It is the one port here that is NOT a containerPort of the selected pod
spec: ztunnel terminates it, not the application. ci/run-networkpolicy-
test.sh holds a NAMED exception for exactly this number, gated on exactly
this value, and proves on a second render that it stays the only such
port and that it is absent while the value is false.
THE PORT HALF ONLY, and that is not an omission. Elsewhere this switch
also adds 169.254.7.127/32 as a probe source, because inside the mesh the
kubelet's probes are redirected away from the worker node's address.
This chart offers no networkPolicy.probeSources at all, so the rule
carrying the probe port is never restricted by source - and an
unrestricted rule needs no probe address. Measured in the render: three
exec probes, which put no packet on the network at all.
WHICH RULE IT JOINS:
the game-port rule, in BOTH of its branches. That rule is open when the
Service is a NodePort (players arrive from outside, already masqueraded)
and restricted to the namespace otherwise, and the two branches are
separate rules in this template - so the port is added twice, or it
would be missing from whichever branch a release happens to render.
NOT MEASURED: that 15008 alone suffices comes from Istio's
documentation. Measured on this cluster is only which listeners ztunnel
opens. Provable at the first namespace to join the mesh; none has. */}}
- protocol: TCP
port: 15008
{{- end }}
from:
- namespaceSelector:
matchLabels: