Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict access to the kube-proxy to local pod connections only #516

Merged
merged 4 commits into from
Mar 4, 2024

Conversation

donatwork
Copy link
Contributor

Description

This PR consists of three items:

  1. Restrict the access of the kube-proxy port to only connections within the client pod.
  2. Update cert-persister version to the latest build and what we are testing now.
  3. Set image pull policy to reduce image downloads.

GitHub Issues

GitHub Issue #
1029

Checklist:

  • I have performed a self-review of my own code to ensure there are no formatting, vetting, linting, or security issues
  • [XI have verified that new and existing unit tests pass locally with my changes
  • I have not allowed coverage numbers to degenerate
  • I have maintained at least 90% code coverage
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • I have maintained backward compatibility

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

  1. Deployed the client and validated that the access to the proxy from outside the pod, within the cluster is blocked. The service is not exported outside the cluster.
  2. Onboarded the cluster and validated that the discovery of the cluster objects was successful, including newly created objects. Checked the client pod logs to validate that incoming watcher connections are being established.

Copy link
Contributor

@jooseppi-luna jooseppi-luna left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@donatwork donatwork merged commit f269388 into main Mar 4, 2024
8 checks passed
@donatwork donatwork deleted the bug-apexclient-access branch March 4, 2024 15:42
ChristianAtDell added a commit that referenced this pull request Oct 15, 2024
* Restrict apex client network access to localhost.
* Update image pull policy.
* Update cert-persister to latest image.
---------
Co-authored-by: Jooseppi Luna <jooseppi_luna@dell.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants