Skip to content

Exclude kube-system and istio-system from ambient mode policy #1297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Exclude kube-system and istio-system from ambient mode policy #1297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions istio/add-ambient-mode-namespace/add-ambient-mode-namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,12 @@ spec:
- resources:
kinds:
- Namespace
exclude:
any:
- resources:
names:
- kube-system
- istio-system
mutate:
patchStrategicMerge:
metadata:
Expand Down
4 changes: 2 additions & 2 deletions istio/add-ambient-mode-namespace/artifacthub-pkg.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: add-ambient-mode-namespace
version: 1.0.0
displayName: Add Istio Ambient Mode
createdAt: "2024-07-25T20:07:52.000Z"
createdAt: "2025-05-28T20:07:52.000Z"
description: >-
In order for Istio to include namespaces in ambient mode, the label `istio.io/dataplane-mode` must be set to `ambient`. As an alternative to rejecting Namespace definitions which don't already contain this label, it can be added automatically. This policy adds the label `istio.io/dataplane-mode` set to `ambient` for all new Namespaces.
install: |-
Expand All @@ -19,4 +19,4 @@ annotations:
kyverno/category: "Istio"
kyverno/kubernetesVersion: "1.24"
kyverno/subject: "Namespace"
digest: f81b9ba15c410e62589f0bf79b22a694b41a2294557c91d3c87683772922a8c0
digest: f4b71db78ff5830b7bf2c4c94af0cd1d5b2495040738a465120f6f96a91affcc