Backport of [NET-10961] Ignore gke managed namespaces by default into…

… release/1.4.x (#4349) * backport of commit 79f171b * backport of commit 7d2782e * remove spaces --------- Co-authored-by: jm96441n <[email protected]>
hashicorp · Sep 20, 2024 · 0ad1edd · 0ad1edd
1 parent 62ff95a
commit 0ad1edd
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/.changelog/4333.txt b/.changelog/4333.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set.
+```
diff --git a/charts/consul/values.yaml b/charts/consul/values.yaml
@@ -2733,6 +2733,7 @@ connectInject:
   # By default, we exclude kube-system since usually users won't
   # want those pods injected and local-path-storage and openebs so that
   # Kind (Kubernetes In Docker) and [OpenEBS](https://openebs.io/) respectively can provision Pods used to create PVCs.
+  # We also exclude gmp-system and gke-managed-cim namespaces that are used by GKE for managing the cluster.
   # Note that this exclusion is only supported in Kubernetes v1.21.1+.
   #
   # Example:
@@ -2747,7 +2748,7 @@ connectInject:
     matchExpressions:
       - key: "kubernetes.io/metadata.name"
         operator: "NotIn"
-        values: ["kube-system","local-path-storage","openebs"]
+        values: ["kube-system","local-path-storage","openebs","gmp-system","gke-managed-cim"]
 
   # List of k8s namespaces to allow Connect sidecar
   # injection in. If a k8s namespace is not included or is listed in `k8sDenyNamespaces`,