feat: course walkthrough and improvement suggestions - #1
Draft
mavogel wants to merge 10 commits into
Draft
Conversation
Signed-off-by: Manuel Vogel <8409778+mavogel@users.noreply.github.com>
Owner
|
Thanks mvogel |
Author
|
I will provide more changes over the course of the next days. When done, I'll remove the draft status |
… after chart version bumps - pin gatekeeper chart version without leading 'v' (chart publishes unprefixed versions) - fix K8sAllowedRegistries Rego logic: it denied an image unless it matched every allowed registry instead of at least one, so enforcement blocked almost everything once Gatekeeper actually started working - allow-list quay.io, registry.k8s.io, registry.istio.io and ghcr.io, the registries the istio, prometheus and gatekeeper charts actually pull from - add targetNamespace to istiod and kube-prometheus-stack so their resources land in istio-system/monitoring instead of flux-system - drop invalid 'namespace'/'image' values from the istio gateway chart (rejected by its values schema; the gateway image is always resolved via sidecar injection) - remove istio-injection: disabled from istio-system: it blocked the sidecar-injector webhook for every pod in the namespace, including the gateway's own image resolution; istiod already self-excludes via its own pod label - size CPU/memory requests and limits across prometheus, grafana, the operator, alertmanager, node-exporter and the istio proxy sidecar, which previously fell back to a 500m LimitRange default (or Istio's 2000m sidecar default) and blew the namespace's ResourceQuota once Gatekeeper began enforcing - drop the redundant Grafana default datasource: kube-prometheus-stack already provisions one, and both marked isDefault: true collided
…head Each namespace's default-quota (limits.cpu: 4) couldn't fit the monitoring stack once istio-injection added proxy sidecars to every pod and the kube-prometheus-stack rolling update briefly ran old and new Grafana pods side by side. Raise requests.cpu 2->3 and limits.cpu 4->8.
Istio only treats '*' as a wildcard when it is the first or last character of the string. The trailing '/' after '*' made 'sa/*/' a literal string that no real principal could ever equal, so the authorized-external-traffic rule silently matched nothing.
- flux_is_ready ran 'flux check --pre', which only validates prerequisites and prints 'prerequisites checks passed', not 'all checks passed'. Drop --pre so it runs the full controller/CRD health check the test name and comment describe. - istio_injection_enabled checked platform-system for istio-injection, but that namespace never carries the label (it's the Pulumi-managed platform namespace, unrelated to the mesh). Check monitoring instead, which is labeled istio-injection: enabled by platform-services.yaml.
Signed-off-by: Manuel Vogel <8409778+mavogel@users.noreply.github.com>
- scripts/port-forward.sh: start/stop/status background kubectl port-forwards, PIDs tracked in gitignored scripts/.port-forward.pids - raise Grafana resources (cpu 500m->1, memory 512Mi->1Gi) - the 200m/500m limits were causing readiness-probe timeouts under load - document local UI access and Grafana admin credentials in Ch02 and root README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
still a WIP