bug: modified add-ambient-mode-namespace to not apply on kube-system nor istio-system namespace#1322
Open
Shreesh-Gawande wants to merge 5 commits intokyverno:mainfrom
Open
bug: modified add-ambient-mode-namespace to not apply on kube-system nor istio-system namespace#1322Shreesh-Gawande wants to merge 5 commits intokyverno:mainfrom
Shreesh-Gawande wants to merge 5 commits intokyverno:mainfrom
Conversation
Signed-off-by: Shreesh Gawande <shreeshgawande10@gmail.com>
…ystem namespace Signed-off-by: Shreesh Gawande <shreeshgawande10@gmail.com>
Member
|
@Shreesh-Gawande - can you please help resolve the conflicts. so we can review and merge? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue(s)
Fixed #1280
Description
What does this PR do?
This PR updates the add-ambient-mode-namespace policy to prevent it from applying to system-critical namespaces. Specifically, it excludes kube-system and istio-system from being automatically labeled for the Istio Ambient data plane.
Additionally, this PR introduces a comprehensive test suite (kyverno-test.yaml) to validate the correctness of this exclusion logic.
Why is this change needed?
The original policy applied the istio.io/dataplane-mode=ambient label to all namespaces indiscriminately. Applying this label to system namespaces like kube-system and istio-system is not recommended and can lead to unexpected behavior or conflicts with core system components.
This change ensures the policy adheres to best practices by targeting only application namespaces, making it safer and more robust.
How were these changes implemented?
Policy Modification: An exclude block was added to the policy rule to explicitly ignore the kube-system and istio-system namespaces.
Test Suite Enhancement: The kyverno-test.yaml manifest has been updated to include test cases that verify:
The policy rule is correctly skipped for kube-system.
The policy rule is correctly skipped for istio-system.