Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP:✨ Phase 1: Add Network Policy #3853

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

camilamacedo86
Copy link
Member

@camilamacedo86 camilamacedo86 commented Apr 7, 2024

This PR replaces the kube-rbac-proxy usage with NetworkPolicy
See that we are:

  • Adding a protection using NetworkPolicies and update the docs
  • Update the e2e tests to use Callico and we are able to ensure that the metrics endpoint is protected.

Motivations

**To understand why it is required see **: https://github.com/kubernetes-sigs/kubebuilder/blob/master/designs/discontinue_usage_of_kube_rbac_proxy.md

What is missing to get done
If we have webhooks scaffold in the project after apply the policy in the namespace we will face issues within. So, we probably need to scaffold a policy for webhooks

kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating "config/samples/barjpwo_v1alpha1_foojpwo.yaml": Internal error occurred: failed calling webhook "mfoojpwo.kb.io": failed to call webhook: Post "[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)": context deadline exceeded
      
      {
          s: "kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating \"config/samples/barjpwo_v1alpha1_foojpwo.yaml\": Internal error occurred: failed calling webhook \"mfoojpwo.kb.io\": failed to call webhook: Post \"[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)\": context deadline exceeded\n",
      }

c/c @ibihim

@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 7, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: camilamacedo86

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 7, 2024
@k8s-ci-robot k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Apr 7, 2024
@camilamacedo86 camilamacedo86 force-pushed the replace-auth-proxy branch 11 times, most recently from 234d7bb to 6c03b83 Compare April 7, 2024 09:55
@camilamacedo86 camilamacedo86 changed the title POC - WIP ⚠️ replace the kube-rbac-proxy usage with NetworkPolicy WIP ⚠️ replace the kube-rbac-proxy usage with NetworkPolicy Apr 7, 2024
@camilamacedo86 camilamacedo86 marked this pull request as ready for review April 7, 2024 10:03
@camilamacedo86 camilamacedo86 changed the title WIP ⚠️ replace the kube-rbac-proxy usage with NetworkPolicy (POC) - WIP ⚠️ replace the kube-rbac-proxy usage with NetworkPolicy Apr 7, 2024
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 7, 2024
@camilamacedo86 camilamacedo86 changed the title (POC) - WIP ⚠️ replace the kube-rbac-proxy usage with NetworkPolicy (POC) - WIP ⚠️ replace the kube-rbac-proxy config with NetworkPolicy Apr 7, 2024
@camilamacedo86 camilamacedo86 force-pushed the replace-auth-proxy branch 5 times, most recently from a70b7b9 to 8d3ca8d Compare April 7, 2024 12:24
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 15, 2024
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 17, 2024
@camilamacedo86 camilamacedo86 changed the title WIP: (BLOCKED BY #3899) ✨ Phase 1: Transition to NetworkPolicies - Add Network Policy WIP:✨ Phase 1: Add Network Policy May 17, 2024
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 22, 2024
@k8s-ci-robot k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels May 24, 2024
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels May 27, 2024
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 27, 2024
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 27, 2024
@k8s-ci-robot
Copy link
Contributor

@camilamacedo86: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-kubebuilder-e2e-k8s-1-27-11 34af3f4 link true /test pull-kubebuilder-e2e-k8s-1-27-11
pull-kubebuilder-e2e-k8s-1-30-0 b44a3a8 link true /test pull-kubebuilder-e2e-k8s-1-30-0
pull-kubebuilder-e2e-k8s-1-28-7 b44a3a8 link true /test pull-kubebuilder-e2e-k8s-1-28-7
pull-kubebuilder-e2e-k8s-1-29-2 b44a3a8 link true /test pull-kubebuilder-e2e-k8s-1-29-2

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

use a NetworkPolicy instead of kube-rbac-proxy
4 participants