influxdata / influxdata/helm-charts

Telegraf-operator - webhook issues with GKE private cluster

Open
#584 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Mustache
Stars
257
Forks
347
Avg merge
4d 20h
Merged PRs (30d)
9

Description

By default GKE private clusters block all traffic between the control plane and kublets/nodes/services besides 443/tcp and 10250/tcp. Being that the webhook listens on port 9443/tcp and is set to ignore failures it is almost impossible to see why sidecars are not being added. This issue is not specific to Telegraf Operator as other pojects run into this. I am looking to get a note added to the documentation for this chart and any other helm carts that depend on a webhook running on ports other than 443 that they need to add a firewall rule for it to work. The fix is pretty simple, just add a rule following this guide.

https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules

Here are other projects that have added notes for GKE private clusters
elastic/cloud-on-k8s#1437
open-telemetry/opentelemetry-operator#1010

Contributor guide

Open the contributing guide

Research direction

Locate the documentation for the affected Helm chart and review the linked GKE private-cluster firewall guide. Add a note explaining that webhook traffic on port 9443 requires a firewall rule in private clusters, and confirm the guidance is clear for users configuring the chart.

Written by the indexing model from the issue text.

Assessment

Tech stack
google-cloud, helm, kubernetes
Domain
cloud, devops, documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.