[installer] Registry facade should not use a port from node ports range #8580

aledbf · 2022-03-03T19:55:38Z

Description

Some CNI providers (as Cilium) do not allow overlap between hostPorts and nodePorts

Release Notes

[installer] Registry facade should not use a port from node ports range

install/installer/pkg/components/cluster/podsecuritypolicies.go

codecov · 2022-03-03T20:05:05Z

Codecov Report

Merging #8580 (a6ed7e3) into main (7ac5d9d) will decrease coverage by 4.94%.
The diff coverage is 0.00%.

❗ Current head a6ed7e3 differs from pull request most recent head feb6d5f. Consider uploading reports for the commit feb6d5f to get more accurate results

@@            Coverage Diff            @@
##             main   #8580      +/-   ##
=========================================
- Coverage   12.31%   7.37%   -4.95%     
=========================================
  Files          20      32      +12     
  Lines        1161    2225    +1064     
=========================================
+ Hits          143     164      +21     
- Misses       1014    2058    +1044     
+ Partials        4       3       -1

Flag	Coverage Δ
components-gitpod-cli-app	`11.17% <ø> (ø)`
components-local-app-app-darwin-amd64	`?`
components-local-app-app-darwin-arm64	`?`
components-local-app-app-linux-amd64	`?`
components-local-app-app-linux-arm64	`?`
components-local-app-app-windows-386	`?`
components-local-app-app-windows-amd64	`?`
components-local-app-app-windows-arm64	`?`
install-installer-raw-app	`4.30% <0.00%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
install/installer/pkg/common/networkpolicies.go	`0.00% <0.00%> (ø)`
components/local-app/pkg/auth/pkce.go
components/local-app/pkg/auth/auth.go
...staller/pkg/components/ws-manager/networkpolicy.go	`0.00% <0.00%> (ø)`
install/installer/pkg/common/ca.go	`0.00% <0.00%> (ø)`
...l/installer/pkg/components/ws-manager/tlssecret.go	`0.00% <0.00%> (ø)`
install/installer/pkg/common/objects.go	`0.00% <0.00%> (ø)`
install/installer/pkg/common/storage.go	`0.00% <0.00%> (ø)`
...nstall/installer/pkg/components/ws-manager/role.go	`0.00% <0.00%> (ø)`
install/installer/pkg/common/render.go	`0.00% <0.00%> (ø)`
... and 6 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7ac5d9d...feb6d5f. Read the comment docs.

mrsimonemms · 2022-03-04T10:06:18Z

/hold

Approving, but adding hold so @aledbf or @sagor999 can merge when ready

install/installer/pkg/components/image-builder-mk3/networkpolicy.go

aledbf · 2022-03-04T11:37:49Z

/hold cancel

aledbf · 2022-03-04T11:39:10Z

with the changes, we can run Gitpod in a cluster using Cilium

and use Hubble to see dropped packages

csweichel · 2022-03-04T11:40:13Z

with the changes, we can run Gitpod in a cluster using Cilium

and use Hubble to see dropped packages

Nice. Is there alerting that could use? E.g. an alert if a package makes its way through to the Google Metadata API server?

aledbf · 2022-03-04T11:44:09Z

Nice. Is there alerting that could use? E.g. an alert if a package makes its way through to the Google Metadata API server?

We can add one using the drop metric https://docs.cilium.io/en/stable/operations/metrics/#drop

mrsimonemms

/hold

Happy with that, just on the question raised. If that's fine, just remove the hold

install/installer/pkg/components/registry-facade/podsecuritypolicy.go

iQQBot · 2022-03-04T20:14:14Z

Unfortunately, this breaks our preview environment @aledbf

sagor999 · 2022-03-04T20:18:16Z

Ah, I think preview env is still using helm chart? So maybe that change needs to be done in there too now

iQQBot · 2022-03-04T20:19:00Z

no, it's using installer

iQQBot · 2022-03-04T20:20:51Z

In order to install multiple gitpod in a single kubernetes, we modified the hostport of registry-facade using the post-install script, but not in the PodSecurityPolicy, which prevented the registry-facade from starting

aledbf · 2022-03-04T20:34:22Z

Now is clear why we had a range in the policy

Fix #8612

aledbf requested review from a team March 3, 2022 19:55

roboquat added release-note size/XS labels Mar 3, 2022

github-actions bot added team: delivery Issue belongs to the self-hosted team team: workspace Issue belongs to the Workspace team labels Mar 3, 2022

sagor999 reviewed Mar 3, 2022

View reviewed changes

install/installer/pkg/components/cluster/podsecuritypolicies.go Outdated Show resolved Hide resolved

[installer] Registry facade should not use a port from node ports range

e61ff35

aledbf force-pushed the aledbf/cil branch from da7f2f0 to e61ff35 Compare March 3, 2022 20:28

sagor999 previously approved these changes Mar 3, 2022

View reviewed changes

Add egress rule to allow access to kube-dns

48f72c1

aledbf dismissed sagor999’s stale review via 48f72c1 March 3, 2022 21:46

roboquat added size/M size/L and removed size/XS size/M labels Mar 3, 2022

Add ws-manager egress rule

50f0ce2

aledbf force-pushed the aledbf/cil branch 3 times, most recently from a6ed7e3 to 76f45e0 Compare March 4, 2022 00:13

roboquat added the do-not-merge/hold label Mar 4, 2022

mrsimonemms previously approved these changes Mar 4, 2022

View reviewed changes

csweichel previously approved these changes Mar 4, 2022

View reviewed changes

install/installer/pkg/components/image-builder-mk3/networkpolicy.go Outdated Show resolved Hide resolved

Enable access to kube-dns

feb6d5f

aledbf dismissed stale reviews from csweichel and mrsimonemms via feb6d5f March 4, 2022 11:16

aledbf force-pushed the aledbf/cil branch from 76f45e0 to feb6d5f Compare March 4, 2022 11:16

roboquat removed the do-not-merge/hold label Mar 4, 2022

aledbf requested review from mrsimonemms, sagor999 and csweichel March 4, 2022 11:47

csweichel approved these changes Mar 4, 2022

View reviewed changes

mrsimonemms approved these changes Mar 4, 2022

View reviewed changes

install/installer/pkg/components/registry-facade/podsecuritypolicy.go Show resolved Hide resolved

roboquat added the do-not-merge/hold label Mar 4, 2022

aledbf removed the do-not-merge/hold label Mar 4, 2022

roboquat merged commit 6d59526 into main Mar 4, 2022

roboquat deleted the aledbf/cil branch March 4, 2022 15:10

roboquat added the deployed: workspace Workspace team change is running in production label Mar 9, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[installer] Registry facade should not use a port from node ports range #8580

[installer] Registry facade should not use a port from node ports range #8580

aledbf commented Mar 3, 2022

codecov bot commented Mar 3, 2022 •

edited

Loading

mrsimonemms commented Mar 4, 2022

aledbf commented Mar 4, 2022

aledbf commented Mar 4, 2022

csweichel commented Mar 4, 2022

aledbf commented Mar 4, 2022 •

edited

Loading

mrsimonemms left a comment

iQQBot commented Mar 4, 2022

sagor999 commented Mar 4, 2022

iQQBot commented Mar 4, 2022

iQQBot commented Mar 4, 2022 •

edited

Loading

aledbf commented Mar 4, 2022 •

edited

Loading

[installer] Registry facade should not use a port from node ports range #8580

[installer] Registry facade should not use a port from node ports range #8580

Conversation

aledbf commented Mar 3, 2022

Description

Release Notes

codecov bot commented Mar 3, 2022 • edited Loading

Codecov Report

mrsimonemms commented Mar 4, 2022

aledbf commented Mar 4, 2022

aledbf commented Mar 4, 2022

csweichel commented Mar 4, 2022

aledbf commented Mar 4, 2022 • edited Loading

mrsimonemms left a comment

Choose a reason for hiding this comment

iQQBot commented Mar 4, 2022

sagor999 commented Mar 4, 2022

iQQBot commented Mar 4, 2022

iQQBot commented Mar 4, 2022 • edited Loading

aledbf commented Mar 4, 2022 • edited Loading

codecov bot commented Mar 3, 2022 •

edited

Loading

aledbf commented Mar 4, 2022 •

edited

Loading

iQQBot commented Mar 4, 2022 •

edited

Loading

aledbf commented Mar 4, 2022 •

edited

Loading