cilium / cilium / 41360

39%

push

travis-ci-com

hubble/relay: Make Peer Service a K8s Service

Currently Hubble-Relay builds its client list by querying
the Peer Service over the local Hubble Unix domain socket.
This goes against best security practices (sharing files
across pods) and is not allowed on platforms that strictly
enforce SELinux policies (e.g. OpenShift).

This PR enables, by default, the creation of a Kubernetes Service
that proxies the Hubble Peer Service so that Hubble-Relay
can use it to build its client list, eliminating the need
for a shared Unix domain socket completely.

Helm values and configurations have been added to enable
the service in a cilium deployment.

Signed-off-by: Nate Sweet <nathanjsweet@pm.me>

24 of 24 new or added lines in 3 files covered. (100.0%)

47419 of 139867 relevant lines covered (33.9%)

3794.35 hits per line