Prepare datapath for policy changes for kube-apiserver#17668
Prepare datapath for policy changes for kube-apiserver#17668joestringer wants to merge 3 commits intocilium:masterfrom
Conversation
|
Commit 0ab49daa7c206fdbb1f926d9b54bbbee14f60b73 does not contain "Signed-off-by". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
|
test-only --focus="K8sVerifier" --kernel_version="net-next" |
There was a problem hiding this comment.
Actually I'm not sure if we really want or need to do this, this can end up in packets which means it could introduce upgrade concerns. Also this code seems to be more related to external workloads which likely means that we would never associate the kube-apiserver identity with this node.
There was a problem hiding this comment.
On the other hand, if this could be a breaking change for that scenario and we ever wanted to assign that identity to that external workload node then maybe we should teach this code about kube-apiserver identity now....?
Create dedicated functions for checking whether an identity represents any node in the cluster or a remote node in the cluster. This will be useful for an upcoming commit where a remote node may have the REMOTE_NODE_ID identity or alternatively another hardcoded identity. Signed-off-by: Joe Stringer <joe@cilium.io>
This identity will be used to identify remote nodes which also have the kube-apiserver colocated, and allows policy at the higher layer to differentiate nodes with this identity vs. other nodes in the cluster. Signed-off-by: Joe Stringer <joe@cilium.io>
0ab49da to
494e013
Compare
|
Commit 494e013 does not contain "Signed-off-by". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
|
test-only --focus="K8sVerifier" --kernel_version="419" EDIT: Results: https://jenkins.cilium.io/job/Cilium-PR-Tests-Kernel-Focus/325/testReport/ |
|
test-only --focus="K8sVerifier" --kernel_version="54" EDIT: Results: https://jenkins.cilium.io/job/Cilium-PR-Tests-Kernel-Focus/326/ |
|
test-only --focus="K8sVerifier" --kernel_version="49" EDIT: Results: https://jenkins.cilium.io/job/Cilium-PR-Tests-Kernel-Focus/327/ |
|
test-only --focus="K8sVerifier" --kernel_version="netnext" |
|
/ci-gke |
|
Superseded by #17823 . |
Read commit-by-commit.
WIP, to be folded into ongoing work with @christarazi.