fix(results): allow retention-policy-agent egress to the API server - #4030
Conversation
The results-retention-policy-agent NetworkPolicy allowed egress to DNS and the database, but not to the Kubernetes API server. The agent uses a ConfigMap watcher (informer) to load its schedule and retention settings from tekton-results-config-results-retention-policy, which requires talking to the API server, not just Postgres/DNS. Signed-off-by: Emil Natan <ena@redhat.com> Assisted-by: Claude <noreply@anthropic.com>
tekton-robot
added
the
release-note-none
tekton-robot
added
the
size/XS
There was a problem hiding this comment.
🟢 Approval recommended
The focused policy correction follows existing helpers and includes appropriate test coverage.
Pull request overview
Allows the Results retention-policy agent to reach the Kubernetes API server for ConfigMap watches.
Changes:
- Adds API-server egress to the retention agent’s NetworkPolicy.
- Tests the new unrestricted egress rule.
File summaries
| File | Description |
|---|---|
pkg/reconciler/kubernetes/tektonresult/networkpolicies.go |
Adds API-server egress. |
pkg/reconciler/kubernetes/tektonresult/networkpolicies_test.go |
Verifies the added rule. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4030 +/- ##
=======================================
Coverage 26.44% 26.44%
=======================================
Files 465 465
Lines 24991 24992 +1
=======================================
+ Hits 6609 6610 +1
Misses 17661 17661
Partials 721 721
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jkhelil The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
|
/lgtm |
|
/cherry-pick release-v0.81.x |
|
✅ Cherry-pick to A new pull request has been created to cherry-pick this change to PR: #4038 Please review and merge the cherry-pick PR. |
The results-retention-policy-agent NetworkPolicy allowed egress to DNS and the database, but not to the Kubernetes API server. The agent uses a ConfigMap watcher (informer) to load its schedule and retention settings from tekton-results-config-results-retention-policy, which requires talking to the API server, not just Postgres/DNS.
Assisted-by: Claude noreply@anthropic.com
Changes
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make test lintbefore submitting a PRSee the contribution guide for more details.
Release Notes