Merge branch 'main' into func-layer-doc

defenseunicorns · Oct 10, 2024 · d6a8d8e · d6a8d8e
2 parents 210b70b + 5df0737
commit d6a8d8e
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 5 deletions.
diff --git a/src/keycloak/chart/templates/uds-package.yaml b/src/keycloak/chart/templates/uds-package.yaml
@@ -26,13 +26,12 @@ spec:
           app: pepr-uds-core-watcher
         port: 8080
 
-      # Temp workaround for any cluster pod
-      # todo: remove this once cluster pods is a remote generated target
       - description: "Keycloak backchannel access"
         direction: Ingress
         selector:
           app.kubernetes.io/name: keycloak
-        remoteGenerated: Anywhere
+        # Allow access from anything in cluster using an empty namespace selector
+        remoteNamespace: "*"
         port: 8080
 
       # Keycloak OCSP to check certs cannot guarantee a static IP

diff --git a/src/pepr/operator/controllers/network/generate.ts b/src/pepr/operator/controllers/network/generate.ts
@@ -3,7 +3,7 @@ import { V1NetworkPolicyPeer, V1NetworkPolicyPort } from "@kubernetes/client-nod
 import { kind } from "pepr";
 
 import { Allow, RemoteGenerated } from "../../crd";
-import { anywhere } from "./generators/anywhere";
+import { anywhere, anywhereInCluster } from "./generators/anywhere";
 import { cloudMetadata } from "./generators/cloudMetadata";
 import { intraNamespace } from "./generators/intraNamespace";
 import { kubeAPI } from "./generators/kubeAPI";
@@ -31,7 +31,7 @@ function getPeers(policy: Allow): V1NetworkPolicyPeer[] {
         break;
 
       case RemoteGenerated.Anywhere:
-        peers = [anywhere];
+        peers = [anywhere, anywhereInCluster];
         break;
     }
   } else if (policy.remoteNamespace !== undefined || policy.remoteSelector !== undefined) {

diff --git a/src/pepr/operator/controllers/network/generators/anywhere.ts b/src/pepr/operator/controllers/network/generators/anywhere.ts
@@ -9,3 +9,11 @@ export const anywhere: V1NetworkPolicyPeer = {
     except: [META_IP],
   },
 };
+
+/** Matches any endpoint in cluster
+ * This is primarily to support Cilium where IP based policies do not match/allow anything in-cluster
+ * Ref: https://github.com/defenseunicorns/uds-core/issues/871 and https://github.com/cilium/cilium/blob/v1.16.2/Documentation/network/kubernetes/policy.rst#networkpolicy
+ */
+export const anywhereInCluster: V1NetworkPolicyPeer = {
+  namespaceSelector: {},
+};