aicam opened a new pull request, #8777:
URL: https://github.com/apache/texera/pull/8777
### What changes were proposed in this PR?
Adds a NetworkPolicy to the computing unit pool namespace so pods in the
pool can no longer open connections to each other. Ingress from every other
namespace is still allowed, so the gateway and the agent service reach
computing units as before.
- It selects every pod in the pool (`podSelector: {}`), not only computing
units, so the image-validation and prepull pods the manager runs there can't
reach a unit either.
- It only restricts ingress. Egress from computing units (Postgres, LakeFS,
object storage, DNS) doesn't change.
- It follows the existing `jupyterPool` policy and is toggled by
`workflowComputingUnitPool.networkPolicy.enabled` (default `true`). Like that
policy, it is only enforced on clusters with a NetworkPolicy controller.
### Any related issues, documentation, discussions?
None.
### How was this PR tested?
Minikube with Calico, chart installed with `values-development.yaml`, two
Kubernetes computing units:
| From | To | Policy on | Policy removed |
|---|---|---|---|
| computing unit 1 | computing unit 2 (DNS and pod IP) | timed out |
connected |
| computing unit 2 | computing unit 1 | timed out | — |
| non-CU pod in the pool namespace | computing unit 1 | timed out | — |
| agent-service pod (`texera-dev`) | both computing units | connected | — |
| throwaway pod in `texera-dev` | computing unit 1 | connected | — |
| browser via gateway (`/wsapi/workflow-websocket`) | both computing units |
connected, state events received | — |
| computing unit 1 | Postgres, LakeFS, RustFS | connected | — |
| Python UDF running on computing unit 2 (from the workspace) | another
computing unit | timed out | — |
`helm upgrade` recreates the policy after it's deleted, and
`bin/k8s/tests/test_helm_values.sh` passes.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5.5)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
