-
Story
-
Resolution: Won't Do
-
Minor
-
None
-
None
-
False
-
False
-
Undefined
-
1. Proposed title of this feature request
Warning message while a user is trying to delete network policies created by Service Mesh.
2. What is the nature and description of the request?
Service Mesh creates the following NetworkPolicies for its operation:
- Two networkpolicies for a member project: "istio-expose-route" allows traffic from the haproxy routers, and "istio-mesh" is the default policy so that all members can communicate with each other, i.e. it allows ingress from other mesh namespaces (i.e. the control plane namespace plus any namespaces listed in ServiceMeshMemberRole).
- Istio-galley, istio-ingress-router etc networkpolicies are being created in the controlplane namespace. Those allow router access to the relevant components (e.g. grafana, jaeger, kiali, prometheus routes), and the ingress network policy allows global access (i.e. any pod in any namespace) to the ingress gateway.
So, if you delete some of that networkpolicies, you can break communication either within Service Mesh instance or between ServiceMesh controlplane and auxillary components.
3. Why does the customer need this? (List the business requirements here)
Would suggest having an RFE wherein any NetworkPolicies created by ServiceMesh is tagged with a label or something of that sort and if the customer tries to delete the same OCP should ask for a verification stating the consequences that may come up as deleting network policies created by service mesh could affect the grid.
4. List any affected packages or components.
Service Mesh - Istio