UNCLASSIFIED - NO CUI

Skip to content

Update Istio networkPolicy ingressLabels to support operatorless istio gateways

Currently the networkPolicies.ingressLabels for many packages are using a similar block of code that refers to .Values.istio.gateways. This needs to be updated to reference the gateway values contained in the istioGateway package.

Snippet from the Vault values.yaml template - (Note .Values.istio.gateways which will be going away)

networkPolicies:
  enabled: {{ .Values.networkPolicies.enabled }}
  istioNamespaceSelector:
  {{ include "istioNamespaceSelector" . | nindent 4 }}  
  ingressLabels:
    {{- $gateway := default "public" .Values.addons.vault.ingress.gateway }}
    {{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
    {{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}

Additional notes:

  • There is an existing helper that might be leveraged.
  • Need to be considerate of the gateway references in these blocks.
  • The current naming convention "passthrough" / "public" allows looking up gateways by the gateway name, but with operatorless istio the Gateway resources and corresponding label selectors have changed to passthrough-ingressgateway and public-ingressgateway which would necessitate appending the -ingressgateway
Edited by Rob Ferguson