Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Users must explicitly enable egress traffic in a denyAll setup #1156

Open
a-thaler opened this issue Jun 7, 2024 · 3 comments
Open

Users must explicitly enable egress traffic in a denyAll setup #1156

a-thaler opened this issue Jun 7, 2024 · 3 comments
Labels
area/manager Manager or module changes kind/bug Categorizes issue or PR as related to a bug.

Comments

@a-thaler
Copy link
Collaborator

a-thaler commented Jun 7, 2024

Description
#536 assumed that users will run a cluster with a denyAll network policy. As the telemetry gateway need to communicate to destinations in the internet, the module defines now an egress which allows all egress for the gateways.
However, that is not in the intention of the user. He mainly want to control all traffic, internal but especially to external. The required internal communication is simple required and should be overwritten by the module. Still, the external communication should be enabled by the user explicitly if wanted. So if the user has a denyAll policy, then the user should explicitly enable the egress to the specific destination in the internet for the module, instead of opening up everything.

Criterias

  • Rethink the egress policies for the gateways and the log agent
  • In a denyAll setup, the user must explicitly enable egress traffic for the gateways/log agent
  • The troubleshooting guides for full data drop gets extended by the scenario of a blocking networkpolicy
@a-thaler a-thaler added kind/bug Categorizes issue or PR as related to a bug. area/manager Manager or module changes labels Jun 7, 2024
Copy link

github-actions bot commented Aug 7, 2024

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs.
Thank you for your contributions.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 7, 2024
Copy link

This issue has been automatically closed due to the lack of recent activity.
/lifecycle rotten

@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Aug 14, 2024
@kyma-bot kyma-bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 14, 2024
@a-thaler a-thaler reopened this Aug 19, 2024
@a-thaler a-thaler removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 19, 2024
Copy link

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs.
Thank you for your contributions.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 19, 2024
@a-thaler a-thaler removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/manager Manager or module changes kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Development

No branches or pull requests

2 participants