Backport of Add support for setting the namespace that the CNI plugin is installed into release/1.0.x #1757
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #1756 to be assessed for backporting due to the inclusion of the label backport/1.0.x.
WARNING automatic cherry-pick of commits failed. Commits will require human attention.
The below text is copied from the body of the original PR.
Kubernetes 1.25 uses the PSA system which controls pod security standards at the namespace level.
The CNI plugin requires elevated permissions which would otherwise interfere with setting the rest of the consul-k8s resources compliant with
restricted
modes of the PSA.By allowing the CNI plugin to be installed into another namespace, like
kube-system
orconsul-system
we can still run the rest of Consul inrestricted
mode while the CNI plugin runs in another elevated namespace.This is a common workflow for other CNI plugins:
Changes proposed in this PR:
namespace
into theconnectInject.cni
stanza which controls which namespace CNI related resources are installed in.How I've tested this PR:
Unit tests + manually test by installing the plugin:
Note to Reviewers:
How I expect reviewers to test this PR:
👀
Checklist:
Overview of commits