Skip to content

chore: enable ambient component for rke2/aks ci#1322

Merged
mjnagel merged 2 commits intomainfrom
ambient-iac
Feb 27, 2025
Merged

chore: enable ambient component for rke2/aks ci#1322
mjnagel merged 2 commits intomainfrom
ambient-iac

Conversation

@mjnagel
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel commented Feb 27, 2025

Description

Enables the istio-ambient component for AKS and RKE2. The main issue was RKE2 is using an SELinux enforcing host, to run properly we had to add SELinux Options to the cni and ztunnel pods. These don't appear to have any effect on non-enforcing hosts (may affect/help with audit log) so we should be safe adding these by default.

Related Issue

Fixes #1222

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Steps to Validate

Success can be validated in the CI output, these components install as expected.

Checklist before merging

@mjnagel mjnagel self-assigned this Feb 27, 2025
@mjnagel mjnagel marked this pull request as ready for review February 27, 2025 18:47
@mjnagel mjnagel requested a review from a team as a code owner February 27, 2025 18:47
@mjnagel mjnagel merged commit c280b03 into main Feb 27, 2025
32 checks passed
@mjnagel mjnagel deleted the ambient-iac branch February 27, 2025 23:45
chance-coleman pushed a commit that referenced this pull request Mar 3, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.37.0](v0.36.2...v0.37.0)
(2025-03-03)


### Features

* kstatus for Pepr
([#1288](#1288))
([c1b78d2](c1b78d2))
* new bundle variable - KEYCLOAK_HEAP_OPTIONS
([#1314](#1314))
([f7e0ebb](f7e0ebb))


### Miscellaneous

* **deps:** update grafana
([#1285](#1285))
([ffda059](ffda059))
* **deps:** update jest to v29.2.6
([#1313](#1313))
([d30c6c7](d30c6c7))
* **deps:** update keycloak to v26.1.3
([#1326](#1326))
([691eebe](691eebe))
* **deps:** update loki
([#1272](#1272))
([54b2cfc](54b2cfc))
* **deps:** update prometheus to 3.2.0, prometheus-operator to 0.80.1
([#1262](#1262))
([d1c6c3c](d1c6c3c))
* **deps:** update prometheus to v3.2.1
([#1321](#1321))
([e1ee576](e1ee576))
* **deps:** update support-deps
([#1289](#1289))
([73f5de2](73f5de2))
* **deps:** update support-deps
([#1323](#1323))
([2822097](2822097))
* **deps:** update vector to 0.45.0
([#1316](#1316))
([c66e807](c66e807))
* enable ambient component for rke2/aks ci
([#1322](#1322))
([c280b03](c280b03))
* switch to azure gov account
([#1318](#1318))
([31ec997](31ec997))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel added a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
## Description

Enables the istio-ambient component for AKS and RKE2. The main issue was
RKE2 is using an SELinux enforcing host, to run properly we had to add
SELinux Options to the cni and ztunnel pods. These don't appear to have
any effect on non-enforcing hosts (may affect/help with audit log) so we
should be safe adding these by default.

## Related Issue

Fixes defenseunicorns#1222

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Other (security config, docs update, etc)

## Steps to Validate

Success can be validated in the CI output, these components install as
expected.

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.37.0](defenseunicorns/uds-core@v0.36.2...v0.37.0)
(2025-03-03)


### Features

* kstatus for Pepr
([defenseunicorns#1288](defenseunicorns#1288))
([c1b78d2](defenseunicorns@c1b78d2))
* new bundle variable - KEYCLOAK_HEAP_OPTIONS
([defenseunicorns#1314](defenseunicorns#1314))
([f7e0ebb](defenseunicorns@f7e0ebb))


### Miscellaneous

* **deps:** update grafana
([defenseunicorns#1285](defenseunicorns#1285))
([ffda059](defenseunicorns@ffda059))
* **deps:** update jest to v29.2.6
([defenseunicorns#1313](defenseunicorns#1313))
([d30c6c7](defenseunicorns@d30c6c7))
* **deps:** update keycloak to v26.1.3
([defenseunicorns#1326](defenseunicorns#1326))
([691eebe](defenseunicorns@691eebe))
* **deps:** update loki
([defenseunicorns#1272](defenseunicorns#1272))
([54b2cfc](defenseunicorns@54b2cfc))
* **deps:** update prometheus to 3.2.0, prometheus-operator to 0.80.1
([defenseunicorns#1262](defenseunicorns#1262))
([d1c6c3c](defenseunicorns@d1c6c3c))
* **deps:** update prometheus to v3.2.1
([defenseunicorns#1321](defenseunicorns#1321))
([e1ee576](defenseunicorns@e1ee576))
* **deps:** update support-deps
([defenseunicorns#1289](defenseunicorns#1289))
([73f5de2](defenseunicorns@73f5de2))
* **deps:** update support-deps
([defenseunicorns#1323](defenseunicorns#1323))
([2822097](defenseunicorns@2822097))
* **deps:** update vector to 0.45.0
([defenseunicorns#1316](defenseunicorns#1316))
([c66e807](defenseunicorns@c66e807))
* enable ambient component for rke2/aks ci
([defenseunicorns#1322](defenseunicorns#1322))
([c280b03](defenseunicorns@c280b03))
* switch to azure gov account
([defenseunicorns#1318](defenseunicorns#1318))
([31ec997](defenseunicorns@31ec997))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Istio Ambient component for UDS Core Base should run in AKS and AWS RKE2

2 participants