doc: Fix clustermesh documentation to set the correct identityMode#12153
doc: Fix clustermesh documentation to set the correct identityMode#12153joestringer merged 1 commit intocilium:masterfrom
Conversation
|
Please set the appropriate release note label. |
|
Coverage increased (+0.001%) to 37.146% when pulling b1f48738e438c7378ba68ff1e5d8e122b0ef6468 on soumynathan:fix-clustermesh-guide into 93d32dd on cilium:master. |
joestringer
left a comment
There was a problem hiding this comment.
Thanks for picking this up. I have a couple of minor comments below.
1aa91de to
b1f4873
Compare
There was a problem hiding this comment.
Unless we shift around how this is configured, I'm not sure there's a better way. Currently it's by default set to crd via the global config map, so we can't detect that it's not configured then apply only in that case.
I'm fine with forcing kvstore mode in this way even though it overrides the user-specified configuration, because I don't see a reason why users would want to use the kvstore but manage identities via CRDs. 👍
There was a problem hiding this comment.
because I don't see a reason why users would want to use the kvstore but manage identities via CRDs.
@joestringer cilium-etcd-operator won't have a security identity because of the chicken-egg problem.
There was a problem hiding this comment.
because I don't see a reason why users would want to use the kvstore but manage identities via CRDs.
@joestringer
cilium-etcd-operatorwon't have a security identity because of the chicken-egg problem.
So @joestringer what do you think, can we leave it this way or do we want to change this.
There was a problem hiding this comment.
@joestringer it's not 100% reliable, I mean it would be less reliable than CRD based identity.
This PR fixes the documentation issues and as well adds in the option through helm when 'etcd' is enabled. Fixes: cilium#12125 Signed-off-by: Swaminathan Vasudevan <svasudevan@suse.com>
b1f4873 to
0e2e136
Compare
There was a problem hiding this comment.
because I don't see a reason why users would want to use the kvstore but manage identities via CRDs.
@joestringer cilium-etcd-operator won't have a security identity because of the chicken-egg problem.
|
@joestringer and @aanm Is there anything else left in this PR that need to be addressed. |
During my testing, I found that if identities are not managed by the kvstore, clustermesh would not be able to enforce security policies correctly. The docs changes reflect the changes necessary there so that side is good. The ConfigMap changes side I'm less sure about. @aanm sounds like you think that we should defer this to the user and not override their setting here if they configure |
|
I spoke with @aanm last week before he went on PTO and he said that as long as this behaviour is expected (clustermesh security policies require |
This PR fixes the documentation issues and as well adds in the option
through helm when 'etcd' is enabled.
Fixes: #12125
Signed-off-by: Swaminathan Vasudevan svasudevan@suse.com