mirror of
https://github.com/argoproj/argo-cd
synced 2026-04-21 17:07:16 +00:00
d73eb8f7fd
* fix: runing local failed Signed-off-by: xiaowu.zhu <xiaowu.zhu@daocloud.io> * fix: Redis egress removal Signed-off-by: May Zhang <may_zhang@intuit.com> --------- Signed-off-by: xiaowu.zhu <xiaowu.zhu@daocloud.io> Signed-off-by: May Zhang <may_zhang@intuit.com> Co-authored-by: yyzxw <1020938856@qq.com>
1.5 KiB
1.5 KiB
v2.8 to 2.9
Upgraded Kustomize Version
Note that bundled Kustomize version has been upgraded from 5.1.0 to 5.2.1.
Egress NetworkPolicy for argocd-redis and argocd-redis-ha-haproxy
Starting with Argo CD 2.9.16, the NetworkPolicy for the argocd-redis and argocd-redis-ha-haproxy dropped Egress restrictions. This change was made
to allow access to the Kubernetes API to create a secret to secure Redis access.
To retain similar networking restrictions as before 2.9.16, you can add an Egress rule to allow access only to the
Kubernetes API and access needed by Redis itself. The Egress rule for Kubernetes access will depend entirely on your
Kubernetes setup. The access for Redis itself can be allowed by adding the following to the
argocd-redis-network-policy NetworkPolicy:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: argocd-redis-network-policy
spec:
policyTypes:
- Ingress
+ - Egress
+ egress:
+ - ports:
+ - port: 53
+ protocol: UDP
+ - port: 53
+ protocol: TCP
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: argocd-redis-ha-haproxy
spec:
policyTypes:
- Ingress
+ - Egress
+ egress:
+ - ports:
+ - port: 6379
+ protocol: TCP
+ - port: 26379
+ protocol: TCP
+ to:
+ - podSelector:
+ matchLabels:
+ app.kubernetes.io/name: argocd-redis-ha
+ - ports:
+ - port: 53
+ protocol: UDP
+ - port: 53
+ protocol: TCP