feat(valkey): networkPolicy.ingress.ambientMesh
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render. Port half only: this chart offers no networkPolicy.probeSources - its probes put no packet on the network - so there is no redirected probe to allow and an ipBlock for one would match nothing while making the rule look like it did something. ci/run-networkpolicy-test.sh ties that exemption to the absence of probeSources, not to a chart name.
This commit is contained in:
4 files changed
+90
-1
No files matched your search
+1
-1
@@ -26,7 +26,7 @@ type: application
|
||||
# running image with no change in this repository and nothing reports it. The
|
||||
# remedy if that ever matters is pinDigests for this one image - see the valkey
|
||||
# block in renovate.json5.
|
||||
version: 2.0.0+up9.1.2.alpine
|
||||
version: 2.1.0+up9.1.2.alpine
|
||||
appVersion: "9.1.2-alpine"
|
||||
|
||||
maintainers:
|
||||
|
||||
@@ -32,6 +32,11 @@ So this policy is what the rest of the rollout aims at and mostly cannot reach:
|
||||
a port that is genuinely closed to everything but the namespaces named below.
|
||||
*/ -}}
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
{{- /* networkPolicy.ingress - the policy's INBOUND side, and not the same
|
||||
thing as the top-level .Values.ingress (the Ingress object) - both match
|
||||
a search for "ingress". */}}
|
||||
{{- $npIngress := .Values.networkPolicy.ingress | default dict }}
|
||||
{{- $ambientMesh := $npIngress.ambientMesh }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
@@ -68,4 +73,41 @@ spec:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6379
|
||||
{{- if $ambientMesh }}
|
||||
{{- /* networkPolicy.ingress.ambientMesh (Gitea #143). 15008/TCP is ztunnel's
|
||||
HBONE tunnel, the port every inbound connection arrives on once the
|
||||
namespace carries istio.io/dataplane-mode - ambient "does not and will
|
||||
never bypass Kubernetes NetworkPolicy enforcement", so without it a pod
|
||||
in the mesh is unreachable.
|
||||
|
||||
It is the one port here that is NOT a containerPort of the selected pod
|
||||
spec: ztunnel terminates it, not the application. ci/run-networkpolicy-
|
||||
test.sh holds a NAMED exception for exactly this number, gated on exactly
|
||||
this value, and proves on a second render that it stays the only such
|
||||
port and that it is absent while the value is false.
|
||||
|
||||
THE PORT HALF ONLY, and that is not an omission. Elsewhere this switch
|
||||
also adds 169.254.7.127/32 as a probe source, because inside the mesh the
|
||||
kubelet's probes are redirected away from the worker node's address.
|
||||
This chart offers no networkPolicy.probeSources at all, so the rule
|
||||
carrying the probe port is never restricted by source - and an
|
||||
unrestricted rule needs no probe address. Measured in the render: three
|
||||
exec probes, which run inside the container through the kubelet's
|
||||
runtime and put no packet on the network at all.
|
||||
WHICH RULE IT JOINS:
|
||||
the only rule this policy has, the one carrying 6379. That rule is
|
||||
ALWAYS restricted to the release's own namespace plus allowedNamespaces,
|
||||
so 15008 is restricted with it - and whether ztunnel is reached by those
|
||||
peers is the open question of #143. ztunnel runs with its own pod IPs in
|
||||
istio-system (measured 2026-10-19: no hostNetwork on the DaemonSet,
|
||||
Istio 1.30.6), so if a peer of its own proves necessary it is
|
||||
expressible as a namespaceSelector plus podSelector and not as an
|
||||
unknowable node CIDR. It cannot be settled before a namespace joins the
|
||||
mesh, and none has.
|
||||
NOT MEASURED: that 15008 alone suffices comes from Istio's
|
||||
documentation. Measured on this cluster is only which listeners ztunnel
|
||||
opens. Provable at the first namespace to join the mesh; none has. */}}
|
||||
- protocol: TCP
|
||||
port: 15008
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -108,6 +108,17 @@
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"ingress": {
|
||||
"description": "The policy's INBOUND side. Three names here overlap as substrings and are not the same thing: the top-level ingress is the Ingress OBJECT this chart renders, networkPolicy.ingress is this block, and networkPolicy.ingressController is the SOURCE SELECTOR for the ingress controller's pods - a SIBLING of this block and no part of it.",
|
||||
"type": ["object", "null"],
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"ambientMesh": {
|
||||
"description": "Opens the pod for Istio's ambient mesh; off by default and additive, so the render is byte-identical while it is false. Renders 15008/TCP inbound - ztunnel's HBONE tunnel, which ambient explicitly does not let bypass NetworkPolicy enforcement - AND, where probeSources is non-empty, 169.254.7.127/32 as an additional probe source, because inside the mesh the kubelet's probes are redirected away from the worker node's address. The two halves are inseparable on purpose: whoever opens 15008 by hand has not added the probe address, and the first narrowed probeSources then drops every probe, so the pod never becomes Ready and the symptom reads as a broken application rather than as a policy. Unproven in operation: that 15008 alone suffices comes from Istio's documentation, and no namespace of this cluster carries istio.io/dataplane-mode yet.",
|
||||
"type": ["boolean", "null"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"enabled": {
|
||||
"description": "On by default. Only a real boundary where the cluster's CNI enforces NetworkPolicies - an unenforced policy is accepted by the API server and filters nothing.",
|
||||
"type": "boolean"
|
||||
|
||||
@@ -279,3 +279,39 @@ networkPolicy:
|
||||
# no typo protection: a namespace name that does not exist matches nothing and
|
||||
# is silently ineffective.
|
||||
allowedNamespaces: []
|
||||
|
||||
# The policy's INBOUND side. Mind the three names that overlap as substrings,
|
||||
# because a search for "ingress" matches all of them and they are different
|
||||
# things:
|
||||
#
|
||||
# ingress (top level) the Ingress OBJECT this chart
|
||||
# renders - host, TLS, className
|
||||
# networkPolicy.ingress this block: what the policy lets IN
|
||||
# networkPolicy.ingressController the SOURCE SELECTOR for the ingress
|
||||
# controller's pods. A SIBLING of this block
|
||||
# and NO PART OF IT, despite the name.
|
||||
ingress:
|
||||
# Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
|
||||
# additive: while it is false this chart renders byte for byte as it did
|
||||
# before the value existed.
|
||||
#
|
||||
# It renders 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
|
||||
# connection arrives on it, and ambient "does not and will never bypass
|
||||
# Kubernetes NetworkPolicy enforcement", so without this port a pod whose
|
||||
# namespace has joined the mesh is unreachable.
|
||||
#
|
||||
# ONE HALF SHORTER THAN ELSEWHERE, deliberately. In other charts this switch
|
||||
# also adds 169.254.7.127/32 as a probe source, because inside the mesh the
|
||||
# kubelet's probes are redirected away from the worker node's address. This
|
||||
# chart has no networkPolicy.probeSources at all, so the rule carrying the
|
||||
# probe port is never restricted by source - and an unrestricted rule needs
|
||||
# no probe address. An ipBlock for one would match nothing while making the
|
||||
# rule look like it did something, which is the kind of strict-looking empty
|
||||
# rule ci/run-networkpolicy-test.sh exists to catch; that script ties the
|
||||
# exemption to the absence of probeSources rather than to a chart name.
|
||||
#
|
||||
# NOT PROVEN: that 15008 alone is enough comes from Istio's documentation;
|
||||
# measured on this cluster is only which listeners ztunnel opens, and no
|
||||
# namespace carries istio.io/dataplane-mode yet.
|
||||
ambientMesh: false
|
||||
|
||||
Reference in new issue
Block a user