jklein
bc580ee291
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render. Port half only: this chart offers no networkPolicy.probeSources - its probes put no packet on the network - so there is no redirected probe to allow and an ipBlock for one would match nothing while making the rule look like it did something. ci/run-networkpolicy-test.sh ties that exemption to the absence of probeSources, not to a chart name.
10 lines
248 B
YAML
10 lines
248 B
YAML
apiVersion: v2
|
|
name: teamspeak-server
|
|
description: A Helm chart for deploying a teamspeak-server on Kubernetes
|
|
icon: https://avatars.githubusercontent.com/u/136759148
|
|
|
|
type: application
|
|
|
|
version: 6.1.0+up6.0.0.beta13.1
|
|
appVersion: "6.0.0-beta13.1"
|