kubebuilder
kubebuilder copied to clipboard
WIP:✨ Phase 1: Add Network Policy
trafficstars
This PR replaces the kube-rbac-proxy usage with NetworkPolicy See that we are:
- Adding a protection using NetworkPolicies and update the docs
- Update the e2e tests to use Callico and we are able to ensure that the metrics endpoint is protected.
Motivations
**To understand why it is required see **: https://github.com/kubernetes-sigs/kubebuilder/blob/master/designs/discontinue_usage_of_kube_rbac_proxy.md
- Closes: https://github.com/kubernetes-sigs/kubebuilder/issues/1885
- Part of: https://github.com/kubernetes-sigs/kubebuilder/issues/3871
What is missing to get done If we have webhooks scaffold in the project after apply the policy in the namespace we will face issues within. So, we probably need to scaffold a policy for webhooks
kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating "config/samples/barjpwo_v1alpha1_foojpwo.yaml": Internal error occurred: failed calling webhook "mfoojpwo.kb.io": failed to call webhook: Post "[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)": context deadline exceeded
{
s: "kubectl -n e2e-jpwo-system apply -f config/samples/barjpwo_v1alpha1_foojpwo.yaml failed with error: (exit status 1) Error from server (InternalError): error when creating \"config/samples/barjpwo_v1alpha1_foojpwo.yaml\": Internal error occurred: failed calling webhook \"mfoojpwo.kb.io\": failed to call webhook: Post \"[https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc:443/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s](https://e2e-jpwo-webhook-service.e2e-jpwo-system.svc/mutate-barjpwo-example-comjpwo-v1alpha1-foojpwo?timeout=10s)\": context deadline exceeded\n",
}
c/c @ibihim