diff --git a/charts/flagger/README.md b/charts/flagger/README.md index 209be8bc6..a186206a3 100644 --- a/charts/flagger/README.md +++ b/charts/flagger/README.md @@ -179,6 +179,8 @@ The following tables lists the configurable parameters of the Flagger chart and | `podPriorityClassName` | PriorityClass name for pod priority configuration | "" | | `podDisruptionBudget.enabled` | A PodDisruptionBudget will be created if `true` | `false` | | `podDisruptionBudget.minAvailable` | The minimal number of available replicas that will be set in the PodDisruptionBudget | `1` | +| `podDisruptionBudget.minAvailable` | The minimal number of available replicas that will be set in the PodDisruptionBudget | `1` | +| `noCrossNamespaceRefs` | If `true`, cross namespace references to custom resources will be disabled. | `false` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade`. For example, diff --git a/charts/flagger/templates/deployment.yaml b/charts/flagger/templates/deployment.yaml index 0418c0119..a854be46b 100644 --- a/charts/flagger/templates/deployment.yaml +++ b/charts/flagger/templates/deployment.yaml @@ -141,6 +141,9 @@ spec: {{- if .Values.clusterName }} - -cluster-name={{ .Values.clusterName }} {{- end }} + {{- if .Values.noCrossNamespaceRefs }} + - -no-cross-namespace-refs={{ .Values.noCrossNamespaceRefs }} + {{- end }} livenessProbe: exec: command: diff --git a/charts/flagger/values.yaml b/charts/flagger/values.yaml index f83480df0..30b5693c6 100644 --- a/charts/flagger/values.yaml +++ b/charts/flagger/values.yaml @@ -165,3 +165,5 @@ podDisruptionBudget: minAvailable: 1 podLabels: {} + +noCrossNamespaceRefs: false diff --git a/docs/gitbook/faq.md b/docs/gitbook/faq.md index e5983df2d..67879e900 100644 --- a/docs/gitbook/faq.md +++ b/docs/gitbook/faq.md @@ -72,6 +72,17 @@ A window of downtime is the intended behavior when the analysis is disabled. Thi a Kubernetes deployment initialization works. To avoid this, enable the analysis (`skipAnalysis: true`), wait for the initialization to finish, and disable it afterward (`skipAnalysis: false`). +#### How to disable cross namespace references? + +Flagger by default can access resources across namespaces (`AlertProivder` and `MetricProvider`). If you're in a multi-tenant enviornemnt +and wish to disable this, you can do so through the `no-cross-namespace-refs` flag. + +``` +flagger \ + -no-cross-namespace-refs=true \ + ... +``` + ## Kubernetes services #### How is an application exposed inside the cluster?