yalindogusahin commented on PR #794:
URL:
https://github.com/apache/spark-kubernetes-operator/pull/794#issuecomment-5329219493
Thank you for the pointer. It makes sense to restrict the metrics port to
explicitly selected peers rather than opening it up, so I have switched to that
direction.
The generated worker `NetworkPolicy ` now carries a from: peer list supplied
by the user under a new `workerSpec.metricsIngress` field, deliberately named
and typed to match `operatorDeployment.networkPolicy.metricsIngress` in the
chart, so the two features read the same way:
```yaml
spec:
workerSpec:
metricsPort: 9404
metricsIngress:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: "monitoring"
```
Both fields are required before any rule is generated: the port alone would
admit every source, and the peers alone would grant them every worker port.
When either is missing, worker ingress is byte-for-byte what it is on main.
One naming question: `metricsIngress` echoes the chart, but ingress may read
as the Kubernetes Ingress resource rather than a NetworkPolicy peer list. I am
happy to rename it if you consider that clearer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
