-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Kindnet network policies #3612
Kindnet network policies #3612
Conversation
/assign @BenTheElder I think I prefer this one, looks nicer simpler and is as if network policies is part of kindnet |
fa99ef1
to
22a33cb
Compare
pkg/cluster/internal/create/actions/installnetworkpolicies/networkpolicies.go
Outdated
Show resolved
Hide resolved
I'm still divided on if it's better to bundle with kindnetd or not but I'm leaning this way. I think if users are sensitive to the base networking they can already disable kindnetd and it's not strictly CNI already. Trying to think of good reasons this wouldn't be reasonable. |
I think this is the way. I haven't come up with good reasons against this one. |
I need to cut a new release of network policies to make it a noop if no network policy is applied kubernetes-sigs/kube-network-policies#39 ... it is much safer |
/hold |
22a33cb
to
7a87183
Compare
/hold cancel waiting for the promotion kubernetes/kubernetes#125681 |
/retest |
7a87183
to
0d44690
Compare
0d44690
to
bb0b4eb
Compare
1aac670
to
379ff55
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like where this is headed 👍
Started working on the go 1.22 bump in #3676, we have to also bump runc and should catch up the rest while we're at it.
what's blocking? I am +1 in concept 👍 |
/retest
😎 vacationing |
379ff55
to
701e455
Compare
@BenTheElder this is ready |
701e455
to
cb720ed
Compare
/test pull-kind-e2e-kubernetes-1-27 can't find the reason it failed |
Change-Id: Ifaa1b6185f59679685ec331ef7922538db1ddcb7
cb720ed
to
cd57e7c
Compare
/hold missing rbac permissions |
Change-Id: I381a548754d31f5249c746e7dbf4e50fe776a34a
/hold cancel added |
) | ||
|
||
require ( | ||
github.com/beorn7/perks v1.0.1 // indirect | ||
github.com/cespare/xxhash/v2 v2.3.0 // indirect |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I assume that you've done the diligence on these and their licenses etc?
looks like most of these are not new but a few are
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
github.com/beorn7/perks, https://github.com/cespare/xxhash github.com/mdlayher/netlink and github.com/florianl/go-nfqueue are MIT
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/approve
/hold
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aojea, BenTheElder The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/hold cancel
|
Fixes: #842
Alternative to #3611
In this case network policies is considerd as part of kindnetd, just is different daemonset.
Users can opt-out by disabling kindnetd