Repository navigation
[tenant] Fix networkpolicy for accessing externalIPs from the cluster - #854
Conversation
Signed-off-by: Andrei Kvapil <[email protected]>
WalkthroughThe changes update the tenant application's Helm chart version from 1.9.1 to 1.9.2 and adjust its network policy to allow ingress from both the "world" and "cluster" entities. Additionally, the version mapping file is updated to reflect the new version, associating 1.9.1 with a specific commit and 1.9.2 with the latest code. No modifications were made to the application's exported or public entities. Changes
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Andrei Kvapil (kvaps)
added
the
kind/backport
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
packages/apps/tenant/Chart.yaml(1 hunks)packages/apps/tenant/templates/networkpolicy.yaml(1 hunks)packages/apps/versions_map(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build and Test
- GitHub Check: Build and Test
🔇 Additional comments (2)
packages/apps/tenant/Chart.yaml (1)
7-7:Details
✅ Verification successful
Chart Version Bump
The chart version has been updated from 1.9.1 to 1.9.2, aligning with the network policy change. Please ensure that any associated Chart.lock (if present) is also updated to reflect this bump.Run the following script to verify Chart.lock (if it exists) has the new version:
🏁 Script executed:
#!/bin/bash # Verify Chart.lock version for tenant chart FILE=$(find packages/apps/tenant -maxdepth 1 -name 'Chart.lock') if [ -f "$FILE" ]; then echo "Found Chart.lock: $FILE" grep -n 'version:' "$FILE" else echo "No Chart.lock found; nothing to verify" fiLength of output: 168
Chart Version Bump Approved
The chart’s version has been correctly updated from 1.9.1 to 1.9.2. NoChart.lockfile was found inpackages/apps/tenant, so there’s nothing further to update.packages/apps/tenant/templates/networkpolicy.yaml (1)
27-27: Enable Cluster Ingress
Added theclusterentity alongsideworldin theallow-external-communicationpolicy to permit cross-cluster traffic for tenant pods, resolving access issues within the cluster.
| tenant 1.9.1 721c12a7 | ||
| tenant 1.9.2 HEAD |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Version Mapping Update
The entry for tenant 1.9.1 is now pinned to commit 721c12a and tenant 1.9.2 points to HEAD, matching the chart bump. Please verify that commit 721c12a correctly corresponds to the v1.9.1 release and that no other services or version maps need adjustment.
Run this script to confirm the commit exists:
🏁 Script executed:
#!/bin/bash
# Check that commit 721c12a7 exists in the repository
if git cat-file -e 721c12a7^{commit}; then
echo "Commit 721c12a7 found"
else
echo "Error: commit 721c12a7 not found"
fiLength of output: 161
Invalid commit SHA for tenant 1.9.1
The mapping now points to 721c12a7, but that commit isn’t in the repo. Please confirm and update the correct SHA for the v1.9.1 release (for example, by running git rev-parse v1.9.1^{commit} or git rev-list -n1 v1.9.1 after fetching tags). Also review other version‑map entries or dependent services to ensure no further updates are needed.
• File: packages/apps/versions_map
Lines 133–134:
‑ tenant 1.9.1 721c12a7
+ tenant 1.9.1 <correct‑commit‑sha>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| tenant 1.9.1 721c12a7 | |
| tenant 1.9.2 HEAD | |
| tenant 1.9.1 <correct‑commit‑sha> | |
| tenant 1.9.2 HEAD |
Andrei Kvapil (kvaps)
changed the title
|
Successfully created backport PR for |
This PR fixes an issue with accessing external IPs of cluster from cluster itself
related doc: https://docs.cilium.io/en/stable/security/policy/language/#entities-based
Summary by CodeRabbit
New Features
Chores