From 7fc5f6d6bb9b5da6cfd0e105771a0870a1963644 Mon Sep 17 00:00:00 2001 From: Sebastian Preisner Date: Wed, 29 Jul 2026 12:09:15 +0200 Subject: [PATCH] helm: say that an egress default-deny needs both toggles networkPolicy.enabled on its own only covers a default-deny that restricts ingress. Where Egress is in its policyTypes as well, which is the usual baseline, the components still cannot resolve DNS and egress.enabled is required too. Both values and the README said the first half of that. Co-Authored-By: Claude Opus 5 (1M context) --- k8s/charts/seaweedfs/README.md | 4 +++- k8s/charts/seaweedfs/values.yaml | 10 ++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md index 1785e714e..a2f2289bf 100644 --- a/k8s/charts/seaweedfs/README.md +++ b/k8s/charts/seaweedfs/README.md @@ -373,7 +373,9 @@ In a namespace with a default-deny policy the install hangs: the components cann helm install seaweedfs seaweedfs/seaweedfs --set networkPolicy.enabled=true ``` -That alone leaves outbound traffic untouched. Restricting egress is a second opt-in, because the chart knows where its own components live but not where your filer store, notification sink or remote tier does: +That alone leaves outbound traffic untouched, which is enough when the namespace's default-deny only restricts ingress. If it lists `Egress` in its `policyTypes` too - the usual baseline - the components still cannot resolve DNS, and you need the second opt-in below as well. + +Egress is separate because the chart knows where its own components live but not where your filer store, notification sink or remote tier does, and because in a namespace with no default-deny at all, adding egress rules would narrow the components from "may reach anything" to "may reach these peers": ```yaml networkPolicy: diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml index 65e8e3161..e7bce0728 100644 --- a/k8s/charts/seaweedfs/values.yaml +++ b/k8s/charts/seaweedfs/values.yaml @@ -1816,6 +1816,11 @@ networkPolicy: # the cluster default (usually allow-all) applies. Turn this on for a # namespace with a default-deny policy, where the components otherwise # cannot reach each other and the install hangs. + # + # This alone covers a default-deny that only restricts ingress. If yours has + # Egress in its policyTypes as well - the usual baseline - the components + # still cannot resolve DNS or reach each other, and you need egress.enabled + # below too, together with an extraEgress entry for the filer store. enabled: false # One policy is rendered per component, selecting its pods by the standard @@ -1861,6 +1866,11 @@ networkPolicy: # components, but not where your filer store (MySQL, Postgres, Redis, # ...), notification sink or remote tier lives. Enabling this without # listing those under extraEgress will cut the filer off from its store. + # + # It cannot be on by default either. In a namespace with no default-deny, + # egress rules would take the components from "may reach anything" down to + # "may reach the peers listed here", which is the same breakage from the + # other direction. Required if your default-deny covers egress. enabled: false # Every component resolves its peers by DNS name, so this is required