[WIP] OCPBUGS-61088: create networkpolicy settings for in-cluster monitoring #2656
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: juzhao The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retitle [WIP] OCPBUGS-61088: create networkpolicy settings for in-cluster monitoring |
openshift-ci
bot
changed the title
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/invalid-bug
|
@juzhao: This pull request references Jira Issue OCPBUGS-61088, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@juzhao: This pull request references Jira Issue OCPBUGS-61088, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: juzhao. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| spec: { | ||
| podSelector: { | ||
| matchLabels: { | ||
| 'app.kubernetes.io/name': 'prometheus-operator', |
There was a problem hiding this comment.
prometheus-operator-admission-webhook rather?
| ], | ||
| }, | ||
| ], | ||
| egress: [ |
There was a problem hiding this comment.
I'm not sure that thee admission webhook needs any egress.
There was a problem hiding this comment.
this allows curl admission webhook enpoint from any pod of any space
| ], | ||
| }, | ||
| ], | ||
| egress: [ |
There was a problem hiding this comment.
Is there any recommendation to allow egress traffic only to the API service? This is the only destination which ksm should try to connect but I guess that it's not trivial to accommodate classic OCP (self-managed) and hosted clusters (HyperShift).
There was a problem hiding this comment.
networkpolicy applied to pod only, seems we can not define for API service, will check again.
| spec: { | ||
| podSelector: { | ||
| matchLabels: { | ||
| 'app.kubernetes.io/name': 'prometheus-operator-admission-webhook', |
|
/retest |
|
/test verify |
|
/retest |
|
@juzhao: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
see https://issues.redhat.com/browse/OCPBUGS-61088, use this bug to set networkpolicy for in-cluster monitoring
this PR replaced #2645, 2645 does not include networkpolicy settings for alertmanager/prometheus/thanos-querier, since there is default deny network settings for all monitoring pods, if we don't include them, CI jobs would be failed for them