mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Timofei Larkin
23c3c54506
An opt-in bundles.system.networkingVariant for the isp-full (Talos) bundle: "cozyplane" swaps kube-ovn, Cilium and kube-proxy for the cozyplane eBPF CNI, its aggregated sdn.cozystack.io apiserver and the cozyplane-kpr socket-LB proxy. The default "kubeovn-cilium" renders identically to main. The variant drops the packages that assume the replaced stack — kubeovn-webhook/-plunger, multus, securitygroup-controller, the virtualprivatecloud app — and turns off sdn aggregation in cozystack-api, since cozyplane owns the group. The selector is validated before any branch is taken: accepted off isp-full it would half-apply, stripping the kube-ovn control plane and the sdn APIService while the Cilium networking package keeps running; and the default "cilium" gateway class is refused on cozyplane, where nothing serves it. The platform's networking.podCIDR and serviceCIDR (and clusterDNS, derived from the service CIDR when not set explicitly) are threaded into the cozyplane component, so the egress masquerade and the VPC gateways' internal denies match the cluster rather than the chart defaults. CiliumNetworkPolicy objects apply but are not enforced on this variant; the values comment, the networking source and the threat model say so, and the threat model records the SecurityGroup split: cozyplane's is a first-class tenant instrument for traffic inside and across VPCs, not cozystack-api's projection onto CiliumNetworkPolicy. Tenant isolation rebuilt on native NetworkPolicy + HostFirewall is a follow-up. Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>