Page MenuHomePhabricator

envoy service proxy: Add networkpolicy egress rule for enabled listeners
Closed, DuplicatePublic

Description

Currently, when adding a listener to discovery.listeners, a corresponding egress networkpolicy needs to be added as well (to allow traffic to the listener).

We should add some helm code to automatically include the needed egress rules for enabled listeners, so no extra configuration (and no specific knowledge of IPs and ports) is needed.

See https://gerrit.wikimedia.org/r/c/operations/deployment-charts/+/630769 for an example.

Event Timeline

JMeybohm triaged this task as Medium priority.Sep 29 2020, 9:21 AM

While not exactly a duplicate, this has been implemented as part of T253058 already.