linkerd
/
linkerd2
mirror of https://github.com/linkerd/linkerd2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use the 'all-unauthenticated' policy with the identity controller (#7110) 

When no default policy is configured, the identity controller uses
`cluster-unauthenticated` by default; but this may not permit
connections from node IPs. This causes installations to fail in some
environments.

This change updates the identity controller's default policy to
`all-unauthenticated` to match the behavior before policy was
introduced.

Fixes #7104
This commit is contained in:
Oliver Gould 2021-10-19 07:36:48 -07:00 committed by GitHub
parent c72fe3f618
commit 9612bbeeaa
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charts/linkerd2/templates/identity.yaml
View File

@ -195,7 +195,7 @@ spec:
The identity controller cannot discover policies, so we configure it with defaults that The identity controller cannot discover policies, so we configure it with defaults that
enforce TLS on the identity service. enforce TLS on the identity service.
*/}} */}}
{{- $_ := set $tree.Values.proxy "defaultInboundPolicy" "cluster-unauthenticated" }} {{- $_ := set $tree.Values.proxy "defaultInboundPolicy" "all-unauthenticated" }}
{{- $_ := set $tree.Values.proxy "requireTLSOnInboundPorts" "8080" }} {{- $_ := set $tree.Values.proxy "requireTLSOnInboundPorts" "8080" }}
- {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }} - {{- include "partials.proxy" $tree | indent 8 | trimPrefix (repeat 7 " ") }}
{{ if not .Values.cniEnabled -}} {{ if not .Values.cniEnabled -}}

2
cli/cmd/testdata/install_controlplane_tracing_output.golden generated vendored
View File

@ -1586,7 +1586,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_custom_domain.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_custom_registry.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_default.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_default_override_dst_get_nets.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8" value: "10.0.0.0/8,100.64.0.0/10,172.0.0.0/8"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_ha_output.golden generated vendored
View File

@ -1654,7 +1654,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_ha_with_overrides_output.golden generated vendored
View File

@ -1654,7 +1654,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_heartbeat_disabled_output.golden generated vendored
View File

@ -1516,7 +1516,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_helm_output.golden generated vendored
View File

@ -1576,7 +1576,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_helm_output_ha.golden generated vendored
View File

@ -1645,7 +1645,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_helm_output_ha_labels.golden generated vendored
View File

@ -1653,7 +1653,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden generated vendored
View File

@ -1645,7 +1645,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_no_init_container.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_output.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "ClusterNetworks" value: "ClusterNetworks"
- name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR

2
cli/cmd/testdata/install_proxy_ignores.golden generated vendored
View File

@ -1585,7 +1585,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT

2
cli/cmd/testdata/install_values_file.golden generated vendored
View File

@ -1571,7 +1571,7 @@ spec:
- name: LINKERD2_PROXY_POLICY_WORKLOAD - name: LINKERD2_PROXY_POLICY_WORKLOAD
value: "$(_pod_ns):$(_pod_name)" value: "$(_pod_ns):$(_pod_name)"
- name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
value: cluster-unauthenticated value: all-unauthenticated
- name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16" value: "10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16"
- name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT