pkg/identity: Watch and update labels for the host#11543
Conversation
6387ff2 to
45c7275
Compare
tgraf
left a comment
There was a problem hiding this comment.
I'm not sure I fully understand yet what this will enable. This will create an identity id 1 with labels which will always remain in the scope of the node as it is reserved. It will thus enable to refer to the local node by its own labels.
I assume this intends to enable referring to other nodes by node labels at some point. That will require to use a non-reserved identity and to allocate an identity instead based on the node labels found on the node.
It will also require to:
- Represents the node IPs as CiliumEndpoint and insert them into the kvstore ipcache
- Individual nodes will no longer have to maintain the ipcache based on CiliumNode or Node events but can instead get their ipcache filled via the CiliumEndpoint or kvstore updates.
Discussed with Paul offline. This PR is specifically limited in scope to enable to select what node a policy applies to. |
This commit adds a k8s watcher for label updates on the host. It allows node network policies to select the nodes based on labels. For now, the same label filters are used for the nodes as for the labels. Whatever the labels it receives, because we know there can be only one host endpoint per node, the host endpoint will always retain its security ID of 1. We therefore don't need to reload the host endpoint's datapaths on label updates. Signed-off-by: Paul Chaignon <paul@cilium.io>
45c7275 to
85f90ff
Compare
|
retest-runtime |
This commit adds a k8s watcher for label updates on the host. It allows node network policies to select the nodes based on labels. For now, the same label filters are used for the nodes as for the labels.
Whatever the labels it receives, because we know there can be only one host endpoint per node, the host endpoint will always retain its security ID of 1. We therefore don't need to reload the host endpoint's datapaths on label updates.