Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: add network policy #875

Merged
merged 32 commits into from
May 23, 2024
Merged

chore: add network policy #875

merged 32 commits into from
May 23, 2024

Conversation

SdgJlbl
Copy link
Contributor

@SdgJlbl SdgJlbl commented Apr 3, 2024 •
edited by guilhem-barthes
Loading

Description

Fixes FL-1457

Companion PR

How has this been tested?

CI below

Checklist

  • changelog was updated with notable changes
  • documentation was updated

@SdgJlbl SdgJlbl force-pushed the chore/add-requests-limits branch 12 times, most recently from 7cfb0b7 to b2ad601 Compare April 11, 2024 10:01
@SdgJlbl SdgJlbl force-pushed the chore/add-requests-limits branch 5 times, most recently from 5e54f01 to 6e9bbeb Compare April 17, 2024 14:46
Base automatically changed from chore/add-requests-limits to main April 18, 2024 12:45
@linear Linear
Copy link

linear bot commented Apr 19, 2024

FL-1457 Implement NetworkPolicies at the namespace level

@guilhem-barthes guilhem-barthes mentioned this pull request Apr 19, 2024
Merged
2 tasks
@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy

@Owlfred
Copy link

Owlfred commented Apr 19, 2024 •
edited
Loading

End to end tests: ❌ FAILURE

Jobs status:

“Boy, that escalated quickly.” ― Ron Burgundy, Anchorman: The Legend of Ron Burgundy

@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy

@Owlfred
Copy link

Owlfred commented Apr 19, 2024 •
edited
Loading

End to end tests: ❌ FAILURE

Jobs status:

I'm sorry.

@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy

@Owlfred
Copy link

Owlfred commented Apr 19, 2024 •
edited
Loading

End to end tests: ❌ FAILURE

Jobs status:

That's a shame.

@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy

@Owlfred
Copy link

Owlfred commented May 8, 2024 •
edited
Loading

End to end tests: ❌ FAILURE

Jobs status:

“Rien ne sert de courir ; il faut partir à point.” ― Jean de La Fontaine (Le Lièvre et la Tortue)

guilhem-barthes and others added 16 commits May 22, 2024 15:30
@guilhem-barthes
chore: test with weaker policy for api k8s
0a86685 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
wip: test with weaker deny all
535f63a 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
chore: remove commented code
1a39b39 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
chore: remove commented code as it is parsed by helm but not k8s
6ea6e6d 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: -api-server-egress was not an array
3b7662b 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: -api-server-egress ipBlock indentation
a5c469a 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: add more private IP range to target kubernetes apiserver
6a59928 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
feat: add server.allowLocalRequests parameter
302b36b 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
chore: remove duplicate network policies (replaced by `allowLocalRequ…
e5273b7 
…ests`)

Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: add role-api-k8s-client: 'true' to builder when `privateCa.ena…
5abdb50 
…bled` is enabled

Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
chore: remove unused deploy.kubectl
f841274 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: allow communication between backends in the same cluster
dbaf27c 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: allow communication between local backends with `allowLocalReque…
953e2ce 
…sts`

Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
fix: readd policy to prevent compute-task to communicate with internet
195b32c 
Signed-off-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
doc: update chart version and changelog
7dad339 
Signed-off-by: Guilhem Barthés <[email protected]>
@SdgJlbl @guilhem-barthes
chore: add network policies for Harbor (#906)
8694b8f 
* chore: add network policies for Harbor

* chore: add newline

Signed-off-by: Guilhem Barthés <[email protected]>

---------

Signed-off-by: Guilhem Barthés <[email protected]>
Co-authored-by: Guilhem Barthés <[email protected]>
@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy

@Owlfred
Copy link

Owlfred commented May 22, 2024 •
edited
Loading

End to end tests: ✔️ SUCCESS

Aw yeah!

@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy --tests sdk,substrafl,frontend,documentation,mnist,camelyon

@Owlfred
Copy link

Owlfred commented May 22, 2024 •
edited
Loading

End to end tests: ❌ FAILURE

Jobs status:

  • Camelyon / camelyon,frontend: ✔️
  • Dispatch Jobs: ✔️
  • Documentation / doc: ❌
  • MNIST / mnist,frontend: ✔️
  • SubstraFL / substrafl,frontend: ✔️
  • SubstraSDK / sdk: ✔️

“Houston, we have a problem.” ― Jim Lovell, Apollo 13

@guilhem-barthes
Copy link
Contributor

/e2e --refs orchestrator=chore/network-policy --tests sdk,substrafl,frontend,documentation,mnist,camelyon

@Owlfred
Copy link

Owlfred commented May 22, 2024 •
edited
Loading

End to end tests: ✔️ SUCCESS

Congratulations!

SdgJlbl
SdgJlbl commented May 22, 2024
View reviewed changes
charts/substra-backend/templates/deployment-registry-prepopulate.yaml
spec:
initContainers:
- name: wait-registry
- name: wait-registry
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👀

SdgJlbl
SdgJlbl commented May 22, 2024
View reviewed changes
Copy link
Contributor Author

@SdgJlbl SdgJlbl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@guilhem-barthes guilhem-barthes merged commit c1d1fde into main May 23, 2024
10 checks passed
@guilhem-barthes guilhem-barthes deleted the chore/network-policy branch May 23, 2024 09:35
guilhem-barthes added a commit to Substra/orchestrator that referenced this pull request May 23, 2024
@guilhem-barthes
chore: network policy (#409)
88d97ff 
## Description

<!-- Please reference issue if any. -->

<!-- Please include a summary of your changes. -->

Fixes FL-1457

## Companion PR

- Substra/substra-backend#875

## How has this been tested?

[CI there](Substra/substra-backend#875)

<!-- Please describe the tests that you ran to verify your changes.  -->

## Checklist

- [ ] [changelog](../CHANGELOG.md) was updated with notable changes
- [ ] documentation was updated

---------

Signed-off-by: Guilhem Barthés <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@guilhem-barthes guilhem-barthes guilhem-barthes approved these changes

Assignees
No one assigned
Labels
compute-engine
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@SdgJlbl @guilhem-barthes @Owlfred