-
Notifications
You must be signed in to change notification settings - Fork 1k
Description
While evaluating the v0.10.0 Helm chart for my usage, I noticed that the Helm chart is missing a few changes from the Kustomize version of the deployment. The commit at 9ad25a9d removes the Service update permission from the controller ClusterRole in the Kustomize manifests as well as dead code that would have updated services. The EndpointSlices feature commit here 312b03cd adds the ability for MetalLB to use EndpointSlices and changes the speaker ClusterRole in the Kustomize manifests so the speaker can access EndpointSlices in the cluster.
I also noticed a difference in the PodSecurityPolicy for the controller where the Kustomize version does not grant the ability to create a host port for the metrics port but the Helm chart does. See these lines in the Helm chart PSP for the controller https://github.com/metallb/metallb/blob/main/charts/metallb/templates/psp.yaml#L15-L17 vs the PSP for the controller in the manifests which lacks that section.