Miscellaneous improvements to DNS introspection policies in connectivity tests #36193
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The manifest appears to have been introduced in 46f3918 ("connectivity: Add Port Range Tests"), but has never been actually used. Hence, let's get rid of it. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Multiple policies leveraged by the connectivity tests depend on DNS introspection to support toFQDN rules. However, they are currently not particularly consistent, each configuring the allowed DNS servers in slightly different ways. Let's consolidate the configuration in a single policy, which is then applied alongside all the others, to ensure consistency and guarantee that modifications apply to all. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Modify the DNS policies to specify a cluster selector to allow targeting DNS servers in the local cluster only, matching best practices. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
It appears to be currently owned by the clustermesh team, even if it is not clustermesh related. Let's assign it to the fqdn team, given that it configures DNS interception. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
|
/test |
giorio94
commented
Nov 27, 2024
nebril
approved these changes
Nov 27, 2024
marseel
approved these changes
Nov 27, 2024
tklauser
approved these changes
Nov 27, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please review commit by commit, and refer to the individual messages for additional details.