Skip to content

Commit

Permalink
Only run flannel host-network CIS netpol controller when using canal CNI
Browse files Browse the repository at this point in the history
This will leave the existing policy in place in case anyone was
depending on it, but new clusters will not have it. Administrators can
delete if if they wish, without risk of the controller putting it back.

Signed-off-by: Brad Davidson <[email protected]>
  • Loading branch information
brandond committed Jan 24, 2024
1 parent a4986a5 commit 5320c49
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 2 deletions.
2 changes: 1 addition & 1 deletion pkg/controllers/cisnetworkpolicy/controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ func register(ctx context.Context,
ctx: ctx,
k8s: k8s,
}
logrus.Debugf("CISNetworkPolicyController: Registering controller hooks")
logrus.Debugf("CISNetworkPolicyController: Registering controller hooks for NetworkPolicy %s", flannelHostNetworkPolicyName)
nodes.OnChange(ctx, "cisnetworkpolicy-node", h.handle)
nodes.OnRemove(ctx, "cisnetworkpolicy-node", h.handle)
return nil
Expand Down
4 changes: 3 additions & 1 deletion pkg/rke2/rke2.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (
rawServer "github.com/k3s-io/k3s/pkg/server"
"github.com/natefinch/lumberjack"
"github.com/pkg/errors"
"github.com/rancher/norman/types/slice"
"github.com/rancher/rke2/pkg/controllers/cisnetworkpolicy"
"github.com/rancher/rke2/pkg/images"
"github.com/sirupsen/logrus"
Expand Down Expand Up @@ -114,7 +115,8 @@ func Server(clx *cli.Context, cfg Config) error {

var leaderControllers rawServer.CustomControllers

if cisMode {
cnis := clx.StringSlice("cni")
if cisMode && (len(cnis) == 0 || slice.ContainsString(cnis, "canal")) {
leaderControllers = append(leaderControllers, cisnetworkpolicy.Controller)
}

Expand Down

0 comments on commit 5320c49

Please sign in to comment.