influxdata / influxdata/helm-charts
Telegraf-operator - webhook issues with GKE private cluster
- Dominant language
- Mustache
- Stars
- 257
- Forks
- 347
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 9
Description
By default GKE private clusters block all traffic between the control plane and kublets/nodes/services besides 443/tcp and 10250/tcp. Being that the webhook listens on port 9443/tcp and is set to ignore failures it is almost impossible to see why sidecars are not being added. This issue is not specific to Telegraf Operator as other pojects run into this. I am looking to get a note added to the documentation for this chart and any other helm carts that depend on a webhook running on ports other than 443 that they need to add a firewall rule for it to work. The fix is pretty simple, just add a rule following this guide.
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules
Here are other projects that have added notes for GKE private clusters
elastic/cloud-on-k8s#1437
open-telemetry/opentelemetry-operator#1010
Contributor guide
Research direction
Locate the documentation for the affected Helm chart and review the linked GKE private-cluster firewall guide. Add a note explaining that webhook traffic on port 9443 requires a firewall rule in private clusters, and confirm the guidance is clear for users configuring the chart.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- google-cloud, helm, kubernetes
- Domain
- cloud, devops, documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100