Network Policies don't have a selector on them

[pbradly]

The Network policies deployed as a part of flux intstall don't have any pod selectors defined on them, meaning if they are deployed into a namespace that has other pods running, it blocks all traffic to other pods in that namespace.

flux2/manifests/policies/deny-ingress.yaml

Line 11 in 6add511

- podSelector: {}

flux2/manifests/policies/deny-ingress.yaml

Line 14 in 6add511

podSelector: {}

Ideally, these policies should only be applied to the flux pods and not across everything in the namespace that flux has been deployed into.

We also discovered that when uninstalling flux v2, if you don't delete the namespace it doesn't remove these network policies.

[stefanprodan]

Ideally, these policies should only be applied to the flux pods and not across everything in the namespace that flux has been deployed into.

Why would deploy other things than Flux in flux-system namespace?

We also discovered that when uninstalling flux v2, if you don't delete the namespace it doesn't remove these network policies.

flux uninstall deletes the namespace for you

[pbradly]

Why would deploy other things than Flux in flux-system namespace?

We didn't deploy other pods into flux-system but instead deployed flux into an already existing namespace. We understand that flux-system is the default if --namespace is not defined.

flux uninstall deletes the namespace for you

Yes this makes sense if flux is deployed into a namespace it creates, but if it's deployed into an already existing namespace, it shouldn't delete that namespace since it didn't create it.

[stefanprodan]

Yes this makes sense if flux is deployed into a namespace it creates, but if it's deployed into an already existing namespace, it shouldn't delete that namespace since it didn't create it.

Fixed in #891

[stefanprodan]

We also discovered that when uninstalling flux v2, if you don't delete the namespace it doesn't remove these network policies.

Fixed in #891

[hiddeco]

As there are no plans to add pod selectors to the network policies at this moment and the other concerns have been addressed, I am closing this issue.

If you still feel they should be added and/or that your request has not been fulfilled, feel free to re-open. ✨