kubebuilder icon indicating copy to clipboard operation
kubebuilder copied to clipboard

WIP:✨ Phase 1: Add Network Policy

Open camilamacedo86 opened this issue 1 year ago • 4 comments
trafficstars

This PR replaces the kube-rbac-proxy usage with NetworkPolicy See that we are:

  • Adding a protection using NetworkPolicies and update the docs
  • Update the e2e tests to use Callico and we are able to ensure that the metrics endpoint is protected.

Motivations

**To understand why it is required see **: https://github.com/kubernetes-sigs/kubebuilder/blob/master/designs/discontinue_usage_of_kube_rbac_proxy.md

  • Closes: https://github.com/kubernetes-sigs/kubebuilder/issues/1885
  • Part of: https://github.com/kubernetes-sigs/kubebuilder/issues/3871

What is missing to get done If we have webhooks scaffold in the project after apply the policy in the namespace we will face issues within. So, we probably need to scaffold a policy for webhooks

kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating "config/samples/barjpwo_v1alpha1_foojpwo.yaml": Internal error occurred: failed calling webhook "mfoojpwo.kb.io": failed to call webhook: Post "[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)": context deadline exceeded
      
      {
          s: "kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating \"config/samples/barjpwo_v1alpha1_foojpwo.yaml\": Internal error occurred: failed calling webhook \"mfoojpwo.kb.io\": failed to call webhook: Post \"[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)\": context deadline exceeded\n",
      }

c/c @ibihim

camilamacedo86 avatar Apr 07 '24 04:04 camilamacedo86