Release v1.4.4 (#79)

* fix-cnp to support dns queries in locked down clusters * Release v1.4.4 --------- Co-authored-by: QuentinBisson <[email protected]>
giantswarm · Feb 19, 2024 · f85935f · f85935f
1 parent 420a96a
commit f85935f
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 ## [Unreleased]
 
+## [1.4.4] - 2024-02-19
+
+### Fixed
+
+- Fix CNP to be able to access DNS.
+
 ## [1.4.3] - 2024-02-14
 
 ### Fixed
@@ -105,7 +111,8 @@ and this project's packages adheres to [Semantic Versioning](http://semver.org/s
 
 - Initial commit with upstream release v0.11.0.
 
-[Unreleased]: https://github.com/giantswarm/sloth-app/compare/v1.4.3...HEAD
+[Unreleased]: https://github.com/giantswarm/sloth-app/compare/v1.4.4...HEAD
+[1.4.4]: https://github.com/giantswarm/sloth-app/compare/v1.4.3...v1.4.4
 [1.4.3]: https://github.com/giantswarm/sloth-app/compare/v1.4.2...v1.4.3
 [1.4.2]: https://github.com/giantswarm/sloth-app/compare/v1.4.1...v1.4.2
 [1.4.1]: https://github.com/giantswarm/sloth-app/compare/v1.4.0...v1.4.1

diff --git a/helm/sloth/templates/cilium-network-policy.yaml b/helm/sloth/templates/cilium-network-policy.yaml
@@ -15,6 +15,23 @@ spec:
         - kube-apiserver
         ## Needed by the init container to be able ot download sloth plugins.
         - world
+    # Allow all DNS queries
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": kube-system
+          "k8s:k8s-app": coredns
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": kube-system
+          "k8s:k8s-app": k8s-dns-node-cache
+      toPorts:
+        - ports:
+           - port: "1053"
+             protocol: ANY
+           - port: "53"
+             protocol: ANY
+          rules:
+            dns:
+              - matchPattern: "*"
   ingress:
     - fromEntities:
       - cluster