fix: allow communication with internet when orchestrator is remote (#913

) * fix: allow communication with internet when orchestrator is remote Signed-off-by: Guilhem Barthés <[email protected]> * doc: bump chart version Signed-off-by: Guilhem Barthés <[email protected]> * fix: indentation Signed-off-by: Guilhem Barthés <[email protected]> * fix: chart version in changelog Signed-off-by: Guilhem Barthés <[email protected]> --------- Signed-off-by: Guilhem Barthés <[email protected]>
Substra · May 27, 2024 · f352d30 · f352d30
1 parent 2315d1f
commit f352d30
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 3 deletions.
diff --git a/charts/substra-backend/CHANGELOG.md b/charts/substra-backend/CHANGELOG.md
@@ -1,6 +1,11 @@
 # Changelog
 
 <!-- towncrier release notes start -->
+## [26.6.3] - 2024-05-27
+
+### Changed
+
+- Allow pods with label `role-orchestrator-client` to communicate with internet when orchestrator is remote (#913)
 
 ## [26.6.2] - 2024-05-24
 

diff --git a/charts/substra-backend/Chart.yaml b/charts/substra-backend/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: substra-backend
 home: https://github.com/Substra
-version: 26.6.2
+version: 26.6.3
 appVersion: 0.45.0
 kubeVersion: ">= 1.19.0-0"
 description: Main package for Substra

diff --git a/charts/substra-backend/templates/networkpolicy-orchestrator-client.yaml b/charts/substra-backend/templates/networkpolicy-orchestrator-client.yaml
@@ -1,4 +1,3 @@
-{{- if .Values.orchestrator.sameCluster }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -11,13 +10,22 @@ spec:
   - Egress
   egress:
   - to:
+    {{- if .Values.orchestrator.sameCluster }}
     - ipBlock:
         cidr: 10.0.0.0/8
     - ipBlock:
         cidr: 192.168.0.0/16
     - ipBlock:
         cidr: 172.16.0.0/20
+    {{- else }}
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 10.0.0.0/8
+        - 192.168.0.0/16
+        - 172.16.0.0/20
+    {{- end -}}
     ports:
     - protocol: TCP
       port: {{ .Values.orchestrator.port }}
-{{- end -}}
+