coulomb/railiance-cluster
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable Knative fail-closed init gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-07-27 07:18:07 +02:00
parent b697778132
commit f1a32bd5a7
4 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
install/knative/README.md
View file

@ -5,6 +5,11 @@ Serving and Kourier v1.22.0 assets before applying them over SSH. It is
idempotent. Kourier is kept `ClusterIP`; public entry through Traefik, DNS, and
TLS requires separate reef admission evidence.
The installer enables only Knative's
`kubernetes.podspec-init-containers` feature. Production workloads use init
containers for fail-closed admission checks such as verifying that egress
policy has reconciled before application code starts.
Run `install.sh railiance01`, then `verify.sh railiance01`.
Before workload admission, rollback deletes Kourier, Serving core, then CRDs

1
install/knative/install.sh
View file

@ -20,5 +20,6 @@ ssh "$target" kubectl wait --for=condition=Available deployment --all -n knative
ssh "$target" kubectl apply -f - < "$stage/kourier.yaml"
ssh "$target" kubectl set image deployment/3scale-kourier-gateway -n kourier-system "kourier-gateway=$ENVOY_IMAGE"
ssh "$target" kubectl patch configmap/config-network -n knative-serving --type merge -p '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}'
ssh "$target" kubectl patch configmap/config-features -n knative-serving --type merge -p '{"data":{"kubernetes.podspec-init-containers":"enabled"}}'
ssh "$target" kubectl patch service/kourier -n kourier-system --type merge -p '{"spec":{"type":"ClusterIP"}}'
ssh "$target" kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=300s

1
install/knative/verify.sh
View file

@ -5,5 +5,6 @@ ssh "$target" 'set -e
test "$(kubectl get namespace knative-serving -o go-template="{{index .metadata.labels \"app.kubernetes.io/version\"}}")" = "1.22.0"
test "$(kubectl get service kourier -n kourier-system -o jsonpath="{.spec.type}")" = "ClusterIP"
test "$(kubectl get configmap config-network -n knative-serving -o jsonpath="{.data.ingress-class}")" = "kourier.ingress.networking.knative.dev"
test "$(kubectl get configmap config-features -n knative-serving -o jsonpath="{.data.kubernetes\\.podspec-init-containers}")" = "enabled"
kubectl wait --for=condition=Available deployment --all -n knative-serving --timeout=120s
kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=120s'