New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
k8s: Update comment about rule preprocessing #25864
Conversation
There is a difference between headless services, and services without a selector (sometimes referred to as external services in cilium). Those services without a selector can be headless or have a ClusterIP; but the important thing, is that this function care about services without a selector, independent on the ClusterIP. Signed-off-by: Odin Ugedal <ougedal@palantir.com> Signed-off-by: Odin Ugedal <odin@uged.al>
.ToService rules only apply to services without selectors. The term headless service is a service without a ClusterIP; and those are distinct terms. Signed-off-by: Odin Ugedal <ougedal@palantir.com>
11ee588
to
44d1008
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you
@joestringer could you take a quick look to see if this is correct from the policy perspective? Do we potentially have more cases where this might be wrong? |
Are we good to merge this now? Want to get this merged to avoid conflicts with other pending work |
Ping @nathanjsweet |
There is a difference between headless services, and services without a selector (sometimes referred to as external services in cilium). Those services without a selector can be headless or have a ClusterIP; but the important thing, is that this function care about services without a selector, independent on the ClusterIP. See commit messages for more context.