jklein
f911a5cddd
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render.
271 lines
13 KiB
YAML
271 lines
13 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
# Routing table of the router: which client-facing hostname is proxied to which
|
|
# backend Minecraft server. Required and must not be empty - a router without
|
|
# routes is not operable, and there is no sensible default.
|
|
# Every entry needs "domain" and "internalUrl"; the optional "port" overrides
|
|
# server.backendPort for that single backend:
|
|
# mappings:
|
|
# - domain: mc.example.com
|
|
# internalUrl: survival-service.minecraft.svc.cluster.local
|
|
# - domain: creative.example.com
|
|
# internalUrl: creative-service.minecraft.svc.cluster.local
|
|
# port: 25566
|
|
# Since chart 2.0.0 a change here rolls the router pod: the deployment carries
|
|
# a checksum/config annotation over the rendered ConfigMap. That restart is
|
|
# required for the change to take effect at all - the config is mounted with
|
|
# subPath and mc-router only reads it at startup - and costs a few seconds of
|
|
# proxy downtime, during which clients cannot connect.
|
|
mappings: null
|
|
|
|
server:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# nodePort of the router Service. 25565 is the Minecraft default port and is
|
|
# deliberately outside the Kubernetes default node-port range (30000-32767) -
|
|
# the cluster runs an extended --service-node-port-range. Do NOT "fix" this
|
|
# into the default range: the Minecraft clients connect to this exact port.
|
|
outwardPort: 25565
|
|
# Port the router listens on for Minecraft client connections (mc-router
|
|
# --port); used as containerPort and as the Service's cluster-internal port.
|
|
port: 25565
|
|
# Default port of the backend Minecraft servers, used for every mapping that
|
|
# does not carry its own "port".
|
|
backendPort: 25565
|
|
# Port of the mc-router HTTP API (--api-binding). Not exposed by the Service;
|
|
# only the probes talk to it.
|
|
apiPort: 8080
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 100m
|
|
memory: 50Mi
|
|
ephemeral-storage: 50Mi
|
|
# The probes query the mc-router API. Even in 1.46.4 there is still no
|
|
# /health or /healthz endpoint - the API server serves GET/POST /routes,
|
|
# POST /defaultRoute, DELETE /routes/{addr}, /vars and /metrics and nothing
|
|
# else - so GET /routes stays the health signal. It answers with the live
|
|
# routing table, and the API server is only started after the routes config
|
|
# has been read and the Minecraft listener is up, so a 200 here means the
|
|
# router is actually serving clients.
|
|
# The "Accept: application/json" header was mandatory in 1.25.1 (the API
|
|
# router matched on it and answered 404 without it); mc-router 1.32.2 dropped
|
|
# that matcher, so from there on the header is optional. It is kept because
|
|
# it is the correct request for a JSON endpoint and the response is identical
|
|
# with and without it - removing it would be churn without any gain.
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /routes
|
|
port: api-port
|
|
httpHeaders:
|
|
- name: Accept
|
|
value: application/json
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /routes
|
|
port: api-port
|
|
httpHeaders:
|
|
- name: Accept
|
|
value: application/json
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. mc-router is a single static Go
|
|
# binary that reads one config file and serves the API in well under a
|
|
# second; budget = periodSeconds * failureThreshold = 30s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /routes
|
|
port: api-port
|
|
httpHeaders:
|
|
- name: Accept
|
|
value: application/json
|
|
periodSeconds: 2
|
|
timeoutSeconds: 5
|
|
failureThreshold: 15
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
# Up to 1.45.x the itzg/mc-router image was built FROM scratch and
|
|
# declared no user, so it would have run as root. Since 1.46.0 it is
|
|
# based on cgr.dev/chainguard/static and declares USER 65532. The chart
|
|
# keeps pinning its own unprivileged uid/gid regardless, so the runtime
|
|
# identity does not silently change with the base image; the statically
|
|
# linked binary needs no particular uid/gid.
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
# Keeps the mounted routing-config ConfigMap readable for that gid.
|
|
fsGroup: 10000
|
|
fsGroupChangePolicy: Always
|
|
# RuntimeDefault applies the container runtime's default seccomp filter,
|
|
# which blocks the syscalls a normal workload never makes. It sits in the
|
|
# pod context on purpose: from here it covers every container in the pod
|
|
# including init containers, while a container-level seccompProfile would
|
|
# have to be repeated for each one (and silently missed on the next one
|
|
# added). A container that genuinely needs a different filter can still
|
|
# override it under securityContext.container, which wins over this value.
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
# No deviation needed: the image ships nothing but the static binary and
|
|
# a CA bundle, mc-router writes nothing, and the only mount is the
|
|
# read-only routing config.
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add: []
|
|
# Extra environment variables for the router container, appended to the ones
|
|
# the chart always sets (ROUTES_CONFIG). This is also how every mc-router
|
|
# option that the chart does not model explicitly is set: mc-router parses
|
|
# its flags with go-flagsfiller, so every "--some-flag" is equally settable
|
|
# as "SOME_FLAG" (that is exactly how ROUTES_CONFIG maps to --routes-config).
|
|
# Useful examples in 1.46.4: LOG_LEVEL (debug/info/warn/error),
|
|
# BACKEND_DIAL_TIMEOUT, CONNECTION_RATE_LIMIT.
|
|
# Values are rendered through tpl and support the value, secretKeyRef and
|
|
# configMapKeyRef forms:
|
|
# - name: SOME_ENV
|
|
# value: "{{ .Release.Name }}"
|
|
# - name: FROM_SECRET
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: "some-secret"
|
|
# key: "someKey"
|
|
# - name: FROM_CONFIGMAP
|
|
# valueFrom:
|
|
# configMapKeyRef:
|
|
# name: "some-configmap"
|
|
# key: "someKey"
|
|
env: []
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# NetworkPolicy (Gitea #5). On by default. The reference implementation with
|
|
# the full reasoning is template-chart; the convention is in README, "Chart
|
|
# style guidelines", and the operator's view on this chart's wiki page.
|
|
# ---------------------------------------------------------------------------
|
|
networkPolicy:
|
|
# WHAT THIS POLICY ALLOWS: inbound the proxy port (server.port, OPEN - it is
|
|
# a NodePort and the senders are players on the internet) and the API port
|
|
# (the probe path, open inside the cluster). Outbound: DNS plus the backend
|
|
# ports DERIVED from the routing table - server.backendPort and the "port"
|
|
# override of every mapping that sets one.
|
|
#
|
|
# So this is one of the few egress caps here that follows the configuration
|
|
# instead of guessing at it: add a backend on a non-standard port and the
|
|
# policy moves with it.
|
|
#
|
|
# WHAT IT DOES NOT DO: the rule permits those PORTS to any destination, not
|
|
# those SERVICES. mappings name hosts (internalUrl), and a NetworkPolicy
|
|
# matches CIDRs and selectors but never hostnames - so anything else
|
|
# listening on a backend port is reachable through this rule too.
|
|
#
|
|
# And the proxy port carries the POD port, not server.outwardPort: a
|
|
# NetworkPolicy is evaluated after kube-proxy has translated the NodePort, so
|
|
# the NodePort number would match nothing while looking strict.
|
|
enabled: true
|
|
# Namespaces whose pods may reach this workload, in addition to the release's
|
|
# own namespace, which is always allowed. Empty means: own namespace only.
|
|
#
|
|
# Matched on the "kubernetes.io/metadata.name" label Kubernetes sets on every
|
|
# namespace itself, so no labelling work is needed on a namespace this chart
|
|
# does not own - and no typo protection either: a name that does not exist
|
|
# matches nothing and is silently ineffective. Note the granularity: an entry
|
|
# opens the port to EVERY pod in that namespace.
|
|
allowedNamespaces: []
|
|
# Source CIDRs allowed to reach the API port (server.apiPort), which is the port all three probes address.
|
|
#
|
|
# EMPTY MEANS OPEN, NOT BLOCKED. With no entry that rule is rendered WITHOUT a
|
|
# "from" selector, so the port is reachable from anywhere the CNI routes to -
|
|
# inside the cluster, since it carries no NodePort.
|
|
#
|
|
# That is the deliberate choice between two bad defaults. The kubelet's probes
|
|
# originate from the IP of the WORKER NODE running the pod, an address this
|
|
# chart cannot know and must not guess: a CIDR that excludes the real node
|
|
# blocks every probe, the pod never becomes Ready, the rollout times out, and
|
|
# the symptom reads as a broken application rather than as a policy.
|
|
#
|
|
# Narrow it by listing the worker node IPs (e.g. ["10.0.1.11/32"]) - and mind
|
|
# the companion trap: once this list is non-empty the rule IS restricted, so
|
|
# everything else that needs the port has to be in it. The chart adds the own
|
|
# namespace and allowedNamespaces to the same rule for exactly that reason.
|
|
probeSources: []
|
|
|
|
# The policy's INBOUND side. Mind the three names that overlap as substrings,
|
|
# because a search for "ingress" matches all of them and they are different
|
|
# things:
|
|
#
|
|
# ingress (top level) the Ingress OBJECT this chart
|
|
# renders - host, TLS, className
|
|
# networkPolicy.ingress this block: what the policy lets IN
|
|
# networkPolicy.ingressController the SOURCE SELECTOR for the ingress
|
|
# controller's pods. A SIBLING of this block
|
|
# and NO PART OF IT, despite the name.
|
|
ingress:
|
|
# Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
|
|
# additive: while it is false this chart renders byte for byte as it did
|
|
# before the value existed.
|
|
#
|
|
# IT RENDERS TWO THINGS, and that they come together is the point:
|
|
#
|
|
# 1. 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
|
|
# connection arrives on it, and ambient "does not and will never bypass
|
|
# Kubernetes NetworkPolicy enforcement", so without this port a pod
|
|
# whose namespace has joined the mesh is unreachable.
|
|
# 2. 169.254.7.127/32 as an additional peer - but ONLY where the rule
|
|
# restricts sources at all, which here means probeSources is non-empty.
|
|
# Inside the mesh the kubelet's probes are redirected and no longer come
|
|
# from the worker node's address.
|
|
#
|
|
# WHY ONE SWITCH AND NOT TWO: point 2 is the one nobody thinks of. Whoever
|
|
# adds "15008" to a port list by hand writes a policy that passes review, and
|
|
# the first time probeSources is narrowed every probe is dropped - the pod
|
|
# never becomes Ready and the symptom reads as a broken application rather
|
|
# than as a policy. A switch whose halves can only be had together cannot be
|
|
# set halfway, which is why this is a named intention and not a port list.
|
|
#
|
|
# TWO THINGS IT DOES NOT PROVE:
|
|
# - That 15008 alone is enough. That comes from Istio's documentation;
|
|
# measured on this cluster is only which listeners ztunnel opens.
|
|
# Provable at the first namespace to join the mesh - none carries
|
|
# istio.io/dataplane-mode yet.
|
|
# - That the probe-source half works. probeSources is empty in every chart
|
|
# here, so no release reaches that branch. CI proves its render, not its
|
|
# effect.
|
|
#
|
|
# Note where the port lands: it joins the rule that carries the probe port,
|
|
# so once probeSources restricts that rule, 15008 is restricted with it.
|
|
# Whether ztunnel needs a peer of its own is open - it runs with its own pod
|
|
# IPs in istio-system (measured: no hostNetwork on the DaemonSet, Istio
|
|
# 1.30.6), so if one proves necessary it is expressible as a
|
|
# namespaceSelector plus podSelector and needs no unknowable node CIDR.
|
|
ambientMesh: false
|
|
|
|
egress:
|
|
# Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
|
|
# has no switch - a knob whose only other setting breaks every name lookup
|
|
# in the pod is a trap, not a feature.
|
|
#
|
|
# PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
|
|
# laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
|
|
# so "only to the database host" cannot be written at all. Each entry
|
|
# permits its port to ANY destination. What the cap still buys is real: a
|
|
# compromised pod cannot open arbitrary outbound connections.
|
|
#
|
|
# Normally empty: the backend ports already come from mappings. Add a port
|
|
# only for something outside the routing table - a status API, for
|
|
# instance.
|
|
extraPorts: []
|