Page MenuHomePhabricator

Stop hardcoding k8s master (k8s API) endpoint IP addresses
Open, HighPublic

Event Timeline

Change #1035756 had a related patch set uploaded (by CDanis; author: CDanis):

[operations/deployment-charts@master] otelcol: deploy k8s attributes processor

https://gerrit.wikimedia.org/r/1035756

Change #1035756 merged by jenkins-bot:

[operations/deployment-charts@master] otelcol: deploy k8sattributes processor

https://gerrit.wikimedia.org/r/1035756

Change #1037179 had a related patch set uploaded (by CDanis; author: CDanis):

[operations/deployment-charts@master] freshen hardcoded IDP addresses

https://gerrit.wikimedia.org/r/1037179

Change #1037179 merged by jenkins-bot:

[operations/deployment-charts@master] freshen hardcoded IDP addresses

https://gerrit.wikimedia.org/r/1037179

This is basically T287491: Allow to address Kubernetes API servers from NetworkPolicy
IMHO the easiest and less intrusive way to do this with an upstream helm chart is to just add a calico networkpolicy template to the chart (the file could even be prefixed with wmf-) that just creates that one policy. The linked phab task should contain some examples for that.

I'm triaging this to high as this is the only place where wikikube k8s control-plane IPs are hardcoded and we already forgot about it once. Also it's pretty easy to fix.

@JMeybohm The best way to fix this is by adding a calico definition to the chart directory in a file whose name starts with wmf-, correct?

@JMeybohm The best way to fix this is by adding a calico definition to the chart directory in a file whose name starts with wmf-, correct?

I think so, yes. Something like https://gerrit.wikimedia.org/r/c/operations/deployment-charts/+/974158