Skip to content

feat: add expose service entry for internal cluster traffic#356

Merged
mjnagel merged 31 commits intomainfrom
add-keycloak-service-entry
May 14, 2024
Merged

feat: add expose service entry for internal cluster traffic#356
mjnagel merged 31 commits intomainfrom
add-keycloak-service-entry

Conversation

@Racer159
Copy link
Copy Markdown
Contributor

@Racer159 Racer159 commented Apr 19, 2024 •
edited
Loading

Description

This adds a service entry to allow traffic to stay inside the cluster and enable things like proper network policies when clients need to access this endpoint.

Related Issue

Fixes #N/A

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Checklist before merging

chance-coleman
chance-coleman previously approved these changes Apr 24, 2024
View reviewed changes
mjnagel
mjnagel reviewed May 3, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this seems okay in general. Broad strokes though, I think this could be done for every virtualservice (and done via pepr generating it based on the spec.expose entry in the Package CR)?

I'm not opposed to rolling forward with just this one, but if we are seeing issues due to cluster -> external LB -> cluster it may make sense to just cover all the things rather than adding one specific one for Keycloak.

@Racer159 Racer159 self-assigned this May 6, 2024
@Racer159 Racer159 requested a review from a team as a code owner May 6, 2024 21:28
@Racer159
Copy link
Copy Markdown
Contributor Author

Racer159 commented May 7, 2024

two ServiceEntries made for keycloak:
image

@Racer159 Racer159 changed the title feat: add a keycloak service entry for internal cluster traffic feat: add expose service entry for internal cluster traffic May 8, 2024
@Racer159 Racer159 requested review from chance-coleman and mjnagel May 8, 2024 14:50
mjnagel
mjnagel reviewed May 8, 2024
View reviewed changes
mjnagel
mjnagel reviewed May 13, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delayed review - LGTM overall just some comment cleanup.

Racer159 and others added 3 commits May 14, 2024 11:28
@Racer159 @mjnagel
Update src/pepr/operator/controllers/istio/istio-resources.ts
f165219 
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@Racer159 @mjnagel
Update src/pepr/operator/controllers/istio/istio-resources.ts
8712757 
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@Racer159
Merge branch 'main' into add-keycloak-service-entry
fff964e
@mjnagel mjnagel merged commit 1bde4cc into main May 14, 2024
@mjnagel mjnagel deleted the add-keycloak-service-entry branch May 14, 2024 18:34
@github-actions github-actions bot mentioned this pull request May 14, 2024
Merged
mjnagel pushed a commit that referenced this pull request May 23, 2024
@github-actions
chore(main): release 0.22.0 (#386)
6367bef 
🤖 I have created a release *beep* *boop*
---


##
[0.22.0](v0.21.1...v0.22.0)
(2024-05-22)


### Features

* add `expose` service entry for internal cluster traffic
([#356](#356))
([1bde4cc](1bde4cc))
* add reconciliation retries for CRs
([#423](#423))
([424b57b](424b57b))
* uds common renovate config
([#391](#391))
([035786c](035786c))
* uds core docs
([#414](#414))
([a35ca7b](a35ca7b))


### Bug Fixes

* mismatched exemption/policy for DropAllCapabilities
([#384](#384))
([d8ec278](d8ec278))
* pepr mutation annotation overwrite
([#385](#385))
([6e56b2a](6e56b2a))
* renovate config grouping, test-infra
([#411](#411))
([05fd407](05fd407))
* renovate pepr comment
([#410](#410))
([a825388](a825388))


### Miscellaneous

* **deps:** update keycloak
([#390](#390))
([3e82c4e](3e82c4e))
* **deps:** update keycloak to v24.0.4
([#397](#397))
([c0420ea](c0420ea))
* **deps:** update keycloak to v24.0.4
([#402](#402))
([e454576](e454576))
* **deps:** update neuvector to v9.4
([#381](#381))
([20d4170](20d4170))
* **deps:** update pepr to 0.31.0
([#360](#360))
([fbd61ea](fbd61ea))
* **deps:** update prometheus-stack
([#348](#348))
([49cb11a](49cb11a))
* **deps:** update prometheus-stack
([#392](#392))
([2e656f5](2e656f5))
* **deps:** update uds to v0.10.4
([#228](#228))
([1750b23](1750b23))
* **deps:** update uds-k3d to v0.6.0
([#398](#398))
([288f009](288f009))
* **deps:** update velero
([#350](#350))
([e7cb33e](e7cb33e))
* **deps:** update zarf to v0.33.2
([#394](#394))
([201a37b](201a37b))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
rjferguson21 pushed a commit that referenced this pull request Jul 11, 2024
@Racer159 @chance-coleman @mjnagel
feat: add expose service entry for internal cluster traffic (#356)
9360671 
## Description

This adds a service entry to allow traffic to stay inside the cluster
and enable things like proper network policies when clients need to
access this endpoint.

## Related Issue

Fixes #N/A

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Other (security config, docs update, etc)

## Checklist before merging

- [X] Test, docs, adr added or updated as needed
- [X] [Contributor Guide
Steps](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request)
followed

---------

Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
rjferguson21 pushed a commit that referenced this pull request Jul 11, 2024
@github-actions
chore(main): release 0.22.0 (#386)
6c40193 
🤖 I have created a release *beep* *boop*
---


##
[0.22.0](v0.21.1...v0.22.0)
(2024-05-22)


### Features

* add `expose` service entry for internal cluster traffic
([#356](#356))
([1bde4cc](1bde4cc))
* add reconciliation retries for CRs
([#423](#423))
([424b57b](424b57b))
* uds common renovate config
([#391](#391))
([035786c](035786c))
* uds core docs
([#414](#414))
([a35ca7b](a35ca7b))


### Bug Fixes

* mismatched exemption/policy for DropAllCapabilities
([#384](#384))
([d8ec278](d8ec278))
* pepr mutation annotation overwrite
([#385](#385))
([6e56b2a](6e56b2a))
* renovate config grouping, test-infra
([#411](#411))
([05fd407](05fd407))
* renovate pepr comment
([#410](#410))
([a825388](a825388))


### Miscellaneous

* **deps:** update keycloak
([#390](#390))
([3e82c4e](3e82c4e))
* **deps:** update keycloak to v24.0.4
([#397](#397))
([c0420ea](c0420ea))
* **deps:** update keycloak to v24.0.4
([#402](#402))
([e454576](e454576))
* **deps:** update neuvector to v9.4
([#381](#381))
([20d4170](20d4170))
* **deps:** update pepr to 0.31.0
([#360](#360))
([fbd61ea](fbd61ea))
* **deps:** update prometheus-stack
([#348](#348))
([49cb11a](49cb11a))
* **deps:** update prometheus-stack
([#392](#392))
([2e656f5](2e656f5))
* **deps:** update uds to v0.10.4
([#228](#228))
([1750b23](1750b23))
* **deps:** update uds-k3d to v0.6.0
([#398](#398))
([288f009](288f009))
* **deps:** update velero
([#350](#350))
([e7cb33e](e7cb33e))
* **deps:** update zarf to v0.33.2
([#394](#394))
([201a37b](201a37b))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel added a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@Racer159 @chance-coleman @mjnagel
feat: add expose service entry for internal cluster traffic (defens…
851d8d1 
…eunicorns#356)

## Description

This adds a service entry to allow traffic to stay inside the cluster
and enable things like proper network policies when clients need to
access this endpoint.

## Related Issue

Fixes #N/A

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Other (security config, docs update, etc)

## Checklist before merging

- [X] Test, docs, adr added or updated as needed
- [X] [Contributor Guide
Steps](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request)
followed

---------

Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.22.0 (defenseunicorns#386)
fc273b9 
🤖 I have created a release *beep* *boop*
---


##
[0.22.0](defenseunicorns/uds-core@v0.21.1...v0.22.0)
(2024-05-22)


### Features

* add `expose` service entry for internal cluster traffic
([defenseunicorns#356](defenseunicorns#356))
([1bde4cc](defenseunicorns@1bde4cc))
* add reconciliation retries for CRs
([defenseunicorns#423](defenseunicorns#423))
([424b57b](defenseunicorns@424b57b))
* uds common renovate config
([defenseunicorns#391](defenseunicorns#391))
([035786c](defenseunicorns@035786c))
* uds core docs
([defenseunicorns#414](defenseunicorns#414))
([a35ca7b](defenseunicorns@a35ca7b))


### Bug Fixes

* mismatched exemption/policy for DropAllCapabilities
([defenseunicorns#384](defenseunicorns#384))
([d8ec278](defenseunicorns@d8ec278))
* pepr mutation annotation overwrite
([defenseunicorns#385](defenseunicorns#385))
([6e56b2a](defenseunicorns@6e56b2a))
* renovate config grouping, test-infra
([defenseunicorns#411](defenseunicorns#411))
([05fd407](defenseunicorns@05fd407))
* renovate pepr comment
([defenseunicorns#410](defenseunicorns#410))
([a825388](defenseunicorns@a825388))


### Miscellaneous

* **deps:** update keycloak
([defenseunicorns#390](defenseunicorns#390))
([3e82c4e](defenseunicorns@3e82c4e))
* **deps:** update keycloak to v24.0.4
([defenseunicorns#397](defenseunicorns#397))
([c0420ea](defenseunicorns@c0420ea))
* **deps:** update keycloak to v24.0.4
([defenseunicorns#402](defenseunicorns#402))
([e454576](defenseunicorns@e454576))
* **deps:** update neuvector to v9.4
([defenseunicorns#381](defenseunicorns#381))
([20d4170](defenseunicorns@20d4170))
* **deps:** update pepr to 0.31.0
([defenseunicorns#360](defenseunicorns#360))
([fbd61ea](defenseunicorns@fbd61ea))
* **deps:** update prometheus-stack
([defenseunicorns#348](defenseunicorns#348))
([49cb11a](defenseunicorns@49cb11a))
* **deps:** update prometheus-stack
([defenseunicorns#392](defenseunicorns#392))
([2e656f5](defenseunicorns@2e656f5))
* **deps:** update uds to v0.10.4
([defenseunicorns#228](defenseunicorns#228))
([1750b23](defenseunicorns@1750b23))
* **deps:** update uds-k3d to v0.6.0
([defenseunicorns#398](defenseunicorns#398))
([288f009](defenseunicorns@288f009))
* **deps:** update velero
([defenseunicorns#350](defenseunicorns#350))
([e7cb33e](defenseunicorns@e7cb33e))
* **deps:** update zarf to v0.33.2
([defenseunicorns#394](defenseunicorns#394))
([201a37b](defenseunicorns@201a37b))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mjnagel mjnagel mjnagel approved these changes

@chance-coleman chance-coleman Awaiting requested review from chance-coleman

+1 more reviewer

@rjferguson21 rjferguson21 rjferguson21 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@Racer159 Racer159

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Racer159 @rjferguson21 @mjnagel @chance-coleman