Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-19 03:57:55 -04:00
Code Issues Projects Releases Packages Wiki Activity

cilium: don't allow remote node identities

Browse source 
The Cilium strict mode has a special mode which
loosens the security a slight bit. For compatability this
mode is enabled by default. But we don't need it for strict
node-to-node encryption. Therefore, we disable it.
This commit is contained in:
Leonard Cohnen 2023-10-26 00:33:48 +02:00 • committed by 3u13r
parent e8840d5fdc
commit 1972b635b4
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
cli/internal/helm/overrides.go
View file

@ -45,7 +45,6 @@ func extraCiliumValues(provider cloudprovider.Provider, conformanceMode bool, ou
strictMode := map[string]any{} strictMode := map[string]any{}
if provider != cloudprovider.QEMU { if provider != cloudprovider.QEMU {
strictMode = map[string]any{ strictMode = map[string]any{
"enabled": true,
"nodeCIDRList": []string{output.IPCidrNode}, "nodeCIDRList": []string{output.IPCidrNode},
} }
} }

3
cli/internal/helm/values.go
View file

@ -21,6 +21,7 @@ var ciliumVals = map[string]map[string]any{
"nodeEncryption": true, "nodeEncryption": true,
"strictMode": map[string]any{ "strictMode": map[string]any{
"enabled": true, "enabled": true,
"allowRemoteNodeIdentities": false,
"podCIDRList": []string{"10.244.0.0/16"}, "podCIDRList": []string{"10.244.0.0/16"},
}, },
}, },
@ -63,6 +64,7 @@ var ciliumVals = map[string]map[string]any{
"nodeEncryption": true, "nodeEncryption": true,
"strictMode": map[string]any{ "strictMode": map[string]any{
"enabled": true, "enabled": true,
"allowRemoteNodeIdentities": false,
"podCIDRList": []string{"10.244.0.0/16"}, "podCIDRList": []string{"10.244.0.0/16"},
}, },
}, },
@ -108,6 +110,7 @@ var ciliumVals = map[string]map[string]any{
"nodeEncryption": true, "nodeEncryption": true,
"strictMode": map[string]any{ "strictMode": map[string]any{
"enabled": true, "enabled": true,
"allowRemoteNodeIdentities": false,
}, },
}, },
"image": map[string]any{ "image": map[string]any{