Update Network Policy Secret management to use SDS #35513
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
a1856db to
2b62f3e
Compare
094e4bb to
4851458
Compare
|
/test |
1 similar comment
|
/test |
149c1ed to
1b28fcf
Compare
sayboras
added a commit
that referenced
this pull request
Nov 19, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 19, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 19, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 19, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 19, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
added a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 25, 2024
This commit is to make sure that we have the coverage for policy secret sync enabled and disabled. Relates: #35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
jongj
pushed a commit
to jongj/cilium
that referenced
this pull request
Feb 11, 2025
This is to cater for the case that SDS secret is ingested later when the curl request is sent, applicable when secret-backend-k8s is enabled. Relates: cilium#36998 Relates: cilium#35513 Signed-off-by: Tam Mach <tam.mach@cilium.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR migrates Network Policy Secret handling to use SDS instead of inlining the secrets inside NPDS.
This has a few advantages:
Some background on using secrets in NetworkPolicy:
There are two ways you can use a Secret in NetworkPolicy, for TLS interception (both termination and origination), and for storing the value of a header that you want to match or add.
TLS Interception seems to be more common, but both are currently implemented.
One additional piece of functionality that this PR preserves is the ability to read "Secrets" specified in CiliumNetworkPolicy via files on the filesystem of the Agent. This functionality was built when Cilium was more focused on non-Kubernetes use cases, and should probably be deprecated and then removed at a later date. Removing this will substantially simplify the code.
This PR also includes all the requisite Helm changes to track secret syncing (similarly to Ingress, Gateway API, and BGP config), and updates the connectivity tests in cilium-cli to use all the new values and functionality correctly.
It also updates the existing TLS Interception docs for the changes, and makes them so that they work (the example app
artii.herokuapp.comis down, this replaces that withhttpbin.org.)Fixes: #24020
For reviewers, reviewing by commits will definitely be easier for this one.
Sorry about the size, this turned out to be a much bigger change than anticipated.