Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: support for anywhere network policies in cilium #884

Merged
merged 3 commits into from
Oct 10, 2024
Merged

fix: support for anywhere network policies in cilium #884

merged 3 commits into from
Oct 10, 2024

Conversation

mjnagel
Copy link
Contributor

@mjnagel mjnagel commented Oct 9, 2024

Description

Reference this doc for the limitations of Cilium with ipBlock based netpols.

Two changes included to support this behavior:

  • Modifies the keycloak backchannel policy to include all namespaces instead of using the Anywhere generated target. This was intended to be anywhere in cluster anyways (see the deleted TODO comment in the diff).
  • Modifies Anywhere target to include both the 0.0.0.0/0 CIDR and an empty namespace selector. For any non-Cilium CNIs 0.0.0.0/0 would've already covered any in-cluster endpoints, so this only changes the behavior for Cilium.

Related Issue

Fixes #871

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Checklist before merging

@mjnagel mjnagel self-assigned this Oct 9, 2024
@mjnagel mjnagel marked this pull request as ready for review October 9, 2024 18:20
@mjnagel mjnagel requested a review from a team as a code owner October 9, 2024 18:20
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 9, 2024 •
edited
Loading

Compliance unicorn Evaluation: success

CC: @defenseunicorns/lula-dev

MxNxPx
MxNxPx approved these changes Oct 10, 2024
View reviewed changes
Copy link
Contributor

@MxNxPx MxNxPx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the speedy fix @mjnagel !!!

UnicornChance
UnicornChance approved these changes Oct 10, 2024
View reviewed changes
Copy link
Contributor

@UnicornChance UnicornChance left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mjnagel mjnagel merged commit 5df0737 into main Oct 10, 2024
21 checks passed
@mjnagel mjnagel deleted the anywhere-netpol-cilium-fix branch October 10, 2024 14:38
@github-actions github-actions bot mentioned this pull request Oct 10, 2024
Merged
mjnagel pushed a commit that referenced this pull request Oct 11, 2024
@github-actions
chore(main): release 0.29.0 (#842)
f42e93c 
🤖 I have created a release *beep* *boop*
---


##
[0.29.0](v0.28.0...v0.29.0)
(2024-10-11)


### Features

* add base and identity layers
([#853](#853))
([b3f532a](b3f532a))
* add logging functional layer
([#861](#861))
([c1a67b9](c1a67b9))
* add metrics-server functional layer
([#865](#865))
([290367a](290367a))
* add monitoring layer
([#872](#872))
([5ecb040](5ecb040))
* add nightly testing for rke2
([#808](#808))
([c401419](c401419))
* add service accounts options to sso
([#852](#852))
([1029162](1029162))
* backup and restore layer, ui layer, runtime security layer
([#862](#862))
([b1d8015](b1d8015))
* grafana-ha
([#838](#838))
([d532d76](d532d76))


### Bug Fixes

* broken readme link
([#899](#899))
([6e47b11](6e47b11))
* **ci:** switch to larger runners to resolve ci disk space issues
([#882](#882))
([1af0401](1af0401))
* snapshot ci version modification and tasks for publish
([#877](#877))
([f01e5bd](f01e5bd))
* support for anywhere network policies in cilium
([#884](#884))
([5df0737](5df0737))


### Miscellaneous

* cleanup license parsing for github
([#881](#881))
([43c98ce](43c98ce))
* **deps:** update chainctl action to v0.2.3
([#864](#864))
([d782b59](d782b59))
* **deps:** update checkout action to v4.2.0
([#825](#825))
([29d1c98](29d1c98))
* **deps:** update dependency defenseunicorns/lula to v0.8.0
([#841](#841))
([fe36150](fe36150))
* **deps:** update githubactions
([#866](#866))
([44f8ea5](44f8ea5))
* **deps:** update grafana to 11.2.1
([#836](#836))
([11383c1](11383c1))
* **deps:** update grafana to v11.2.2
([#867](#867))
([06ed2c3](06ed2c3))
* **deps:** update loki nginx image to v1.27.2
([#894](#894))
([df7d427](df7d427))
* **deps:** update loki to v3.2.0
([#791](#791))
([d3c60b5](d3c60b5))
* **deps:** update metrics-server chart to v3.12.2
([#873](#873))
([e2e61ce](e2e61ce))
* **deps:** update pepr to v0.37.1
([#843](#843))
([68abcb2](68abcb2))
* **deps:** update pepr to v0.37.2
([#850](#850))
([b51f659](b51f659))
* **deps:** update prometheus operator to 0.77.1
([#819](#819))
([0864b33](0864b33))
* **deps:** update prometheus-stack
([#855](#855))
([c791c24](c791c24))
* **deps:** update prometheus-stack helm-charts to v64.0.0
([#849](#849))
([50a2588](50a2588))
* **deps:** update runtime to v0.6.0
([#897](#897))
([89ae6e2](89ae6e2))
* **deps:** update support-deps
([#890](#890))
([26ea612](26ea612))
* **deps:** update test-infra
([#875](#875))
([583f07c](583f07c))
* **deps:** update test-infra to v6.9.0
([#848](#848))
([ef9d317](ef9d317))
* **deps:** update uds to v0.17.0
([#859](#859))
([1489fef](1489fef))
* **deps:** update zarf to v0.41.0
([#857](#857))
([a390c3d](a390c3d))
* **docs:** update doc structure for site refresh
([#895](#895))
([1946a9a](1946a9a))
* fix broken link in docs
([#845](#845))
([3078a5b](3078a5b))
* fix license header references
([#901](#901))
([cf38b82](cf38b82))
* handle upgrade path for functional layers, add doc for usage
([#896](#896))
([70d6b1b](70d6b1b))
* regroup 'support dependencies' in renovate config
([#885](#885))
([640d859](640d859))
* update license
([#878](#878))
([b086170](b086170))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
docandrew pushed a commit that referenced this pull request Oct 17, 2024
@mjnagel @docandrew
fix: support for anywhere network policies in cilium (#884)
57f7fa8 
## Description

Reference [this
doc](https://github.com/cilium/cilium/blob/v1.16.2/Documentation/network/kubernetes/policy.rst#networkpolicy)
for the limitations of Cilium with `ipBlock` based netpols.

Two changes included to support this behavior:
- Modifies the keycloak backchannel policy to include all namespaces
instead of using the `Anywhere` generated target. This was intended to
be anywhere in cluster anyways (see the deleted TODO comment in the
diff).
- Modifies `Anywhere` target to include both the `0.0.0.0/0` CIDR and an
empty namespace selector. For any non-Cilium CNIs `0.0.0.0/0` would've
already covered any in-cluster endpoints, so this only changes the
behavior for Cilium.

## Related Issue

Fixes #871

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
docandrew pushed a commit that referenced this pull request Oct 17, 2024
@github-actions @docandrew
chore(main): release 0.29.0 (#842)
e7cbfc2 
🤖 I have created a release *beep* *boop*
---


##
[0.29.0](v0.28.0...v0.29.0)
(2024-10-11)


### Features

* add base and identity layers
([#853](#853))
([b3f532a](b3f532a))
* add logging functional layer
([#861](#861))
([c1a67b9](c1a67b9))
* add metrics-server functional layer
([#865](#865))
([290367a](290367a))
* add monitoring layer
([#872](#872))
([5ecb040](5ecb040))
* add nightly testing for rke2
([#808](#808))
([c401419](c401419))
* add service accounts options to sso
([#852](#852))
([1029162](1029162))
* backup and restore layer, ui layer, runtime security layer
([#862](#862))
([b1d8015](b1d8015))
* grafana-ha
([#838](#838))
([d532d76](d532d76))


### Bug Fixes

* broken readme link
([#899](#899))
([6e47b11](6e47b11))
* **ci:** switch to larger runners to resolve ci disk space issues
([#882](#882))
([1af0401](1af0401))
* snapshot ci version modification and tasks for publish
([#877](#877))
([f01e5bd](f01e5bd))
* support for anywhere network policies in cilium
([#884](#884))
([5df0737](5df0737))


### Miscellaneous

* cleanup license parsing for github
([#881](#881))
([43c98ce](43c98ce))
* **deps:** update chainctl action to v0.2.3
([#864](#864))
([d782b59](d782b59))
* **deps:** update checkout action to v4.2.0
([#825](#825))
([29d1c98](29d1c98))
* **deps:** update dependency defenseunicorns/lula to v0.8.0
([#841](#841))
([fe36150](fe36150))
* **deps:** update githubactions
([#866](#866))
([44f8ea5](44f8ea5))
* **deps:** update grafana to 11.2.1
([#836](#836))
([11383c1](11383c1))
* **deps:** update grafana to v11.2.2
([#867](#867))
([06ed2c3](06ed2c3))
* **deps:** update loki nginx image to v1.27.2
([#894](#894))
([df7d427](df7d427))
* **deps:** update loki to v3.2.0
([#791](#791))
([d3c60b5](d3c60b5))
* **deps:** update metrics-server chart to v3.12.2
([#873](#873))
([e2e61ce](e2e61ce))
* **deps:** update pepr to v0.37.1
([#843](#843))
([68abcb2](68abcb2))
* **deps:** update pepr to v0.37.2
([#850](#850))
([b51f659](b51f659))
* **deps:** update prometheus operator to 0.77.1
([#819](#819))
([0864b33](0864b33))
* **deps:** update prometheus-stack
([#855](#855))
([c791c24](c791c24))
* **deps:** update prometheus-stack helm-charts to v64.0.0
([#849](#849))
([50a2588](50a2588))
* **deps:** update runtime to v0.6.0
([#897](#897))
([89ae6e2](89ae6e2))
* **deps:** update support-deps
([#890](#890))
([26ea612](26ea612))
* **deps:** update test-infra
([#875](#875))
([583f07c](583f07c))
* **deps:** update test-infra to v6.9.0
([#848](#848))
([ef9d317](ef9d317))
* **deps:** update uds to v0.17.0
([#859](#859))
([1489fef](1489fef))
* **deps:** update zarf to v0.41.0
([#857](#857))
([a390c3d](a390c3d))
* **docs:** update doc structure for site refresh
([#895](#895))
([1946a9a](1946a9a))
* fix broken link in docs
([#845](#845))
([3078a5b](3078a5b))
* fix license header references
([#901](#901))
([cf38b82](cf38b82))
* handle upgrade path for functional layers, add doc for usage
([#896](#896))
([70d6b1b](70d6b1b))
* regroup 'support dependencies' in renovate config
([#885](#885))
([640d859](640d859))
* update license
([#878](#878))
([b086170](b086170))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@UnicornChance UnicornChance UnicornChance approved these changes

@MxNxPx MxNxPx MxNxPx approved these changes

Assignees

@mjnagel mjnagel

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

IP based netpols can't select in cluster resources with Cilium CNI
3 participants
@mjnagel @MxNxPx @UnicornChance