You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description #536 assumed that users will run a cluster with a denyAll network policy. As the telemetry gateway need to communicate to destinations in the internet, the module defines now an egress which allows all egress for the gateways.
However, that is not in the intention of the user. He mainly want to control all traffic, internal but especially to external. The required internal communication is simple required and should be overwritten by the module. Still, the external communication should be enabled by the user explicitly if wanted. So if the user has a denyAll policy, then the user should explicitly enable the egress to the specific destination in the internet for the module, instead of opening up everything.
Criterias
Rethink the egress policies for the gateways and the log agent
In a denyAll setup, the user must explicitly enable egress traffic for the gateways/log agent
The troubleshooting guides for full data drop gets extended by the scenario of a blocking networkpolicy
The text was updated successfully, but these errors were encountered:
This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs.
Thank you for your contributions.
kyma-bot
added
lifecycle/rotten
Denotes an issue or PR that has aged beyond stale and will be auto-closed.
and removed
lifecycle/stale
Denotes an issue or PR has remained open with no activity and has become stale.
labels
Aug 14, 2024
This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs.
Thank you for your contributions.
Description
#536 assumed that users will run a cluster with a denyAll network policy. As the telemetry gateway need to communicate to destinations in the internet, the module defines now an egress which allows all egress for the gateways.
However, that is not in the intention of the user. He mainly want to control all traffic, internal but especially to external. The required internal communication is simple required and should be overwritten by the module. Still, the external communication should be enabled by the user explicitly if wanted. So if the user has a denyAll policy, then the user should explicitly enable the egress to the specific destination in the internet for the module, instead of opening up everything.
Criterias
The text was updated successfully, but these errors were encountered: