-
Notifications
You must be signed in to change notification settings - Fork 323
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Re-use connectInject.consulNamespaces for API Gateway #1169
Conversation
@nathancoleman looks like some stray empty waypoint server files accidentally got checked in. |
Co-authored-by: Andrew Stucki <[email protected]>
@@ -1,5 +1,9 @@ | |||
## UNRELEASED | |||
|
|||
BREAKING CHANGES: | |||
* Helm | |||
* API Gateway: Re-use connectInject.consulNamespaces instead of requiring that apiGateway.consulNamespaces have the same value when ACLs are enabled. [[GH-1169](https://github.com/hashicorp/consul-k8s/pull/1169)] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not a big deal but for BC's it's nice to tell the user what to do. So in this case if their apiGateway.consulNamespaces
is the same as their connectInject.consulNamespaces
configuration, they don't have to do anything. If it's different, then they need to be aware that the connectInject.consulNamespaces
will now be used.
Background:
If ACLs are enabled and a user doesn't have identical mappings for the helm chart under
connectInject.consulNamespaces
andapiGateway.consulNamespaces
, everything breaks. This is because the API Gateway uses a combination of both internally which results in a gateway trying to register itself under a different Consul namespace than it is authorized to.After talking with @lkysow, we determined that these two
consulNamespaces
options should really be one and the same. Letting them diverge breaks many uses cases. In addition, it's cumbersome for the practitioner to have to specify both with the exact same value.Changes proposed in this PR:
apiGateway.consulNamespaces
and instead re-useconnectInject.consulNamespaces
for the API Gateway installationHow I've tested this PR:
Installed chart from this branch with various
connectInject.consulNamespaces
configurations, verifying that those values are piped through to the API Gateway controller Deployment spec just as they were previously fromapiGateway.consulNamespaces
.Example
How I expect reviewers to test this PR:
Checklist: