Repository navigation
[tenant] Allow egress to virt-handler for VM metrics scraping - #2199
Merged
Andrei Kvapil (kvaps) merged 1 commit intoMar 10, 2026
Merged
Andrei Kvapil (kvaps) merged 1 commit into
Andrei Kvapil (kvaps) merged 1 commit into
Conversation
dosubot
Bot
added
size/S
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a conditional Helm template block that defines a CiliumClusterwideNetworkPolicy enabling egress from the tenant namespace to the virt-handler service on TCP port 8443 when Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/apps/tenant/templates/networkpolicy.yaml`:
- Around line 217-219: The rule currently uses endpointSelector with matchLabels
"k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" .}}" which allows
all pods in the tenant namespace to reach virt-handler:8443; restrict it to only
the monitoring scraper pods by replacing the namespace-wide selector with a
pod-level selector that matches the monitoring scraper label (e.g., the vmagent
app label or a scrape opt-in label such as app: vmagent or prometheus.io/scrape:
"true") so only vmagent/monitoring pods are allowed to target virt-handler:8443;
update the endpointSelector/matchLabels in the template accordingly (keeping
tenant.name for scoping if needed) and ensure the selected label matches the
actual label used by your vmagent pods.
- Around line 221-224: The NetworkPolicy uses toEndpoints with matchLabels for
the virt-handler pod (labels "k8s:kubevirt.io": "virt-handler" and
"k8s:io.kubernetes.pod.namespace": "cozy-kubevirt"), but virt-handler runs with
hostNetwork: true so pod-based endpoint selectors won't match; either update the
KubeVirt deployment via the KubeVirt CR's customizeComponents to disable
hostNetwork for virt-handler (so matchLabels/toEndpoints will work) or modify
this NetworkPolicy to target host traffic instead (e.g., replace the toEndpoints
rule with a host-targeting rule such as toEntity: host or equivalent CIDR-based
egress/ingress) and ensure the virt-handler label references are removed or
adjusted accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ac054275-b699-49ac-8219-1c233b114a00
📒 Files selected for processing (1)
packages/apps/tenant/templates/networkpolicy.yaml
- Add CiliumClusterwideNetworkPolicy for vmagent egress to virt-handler - Restrict endpointSelector to vmagent pods only via app.kubernetes.io/name label Signed-off-by: Mattia Eleuteri <[email protected]> Signed-off-by: mattia-eleuteri <[email protected]>
mattia-eleuteri
force-pushed
the
tenant/egress-virt-handler
branch
from
March 10, 2026 15:57
05ca58c to
630dfc7
Compare
1 of 12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CiliumClusterwideNetworkPolicyallowing egress from tenant pods tovirt-handlerincozy-kubevirtnamespace on port 8443/TCP.Values.monitoringbeing enabledProblem
Tenant vmagent cannot scrape KubeVirt VM metrics from
virt-handlerbecause no network policy allows the traffic.Relates to #2194
Test plan
helm templatetenant withmonitoring: true— virt-handler policy presenthelm templatetenant withmonitoring: false— virt-handler policy absent🤖 Generated with Claude Code
Summary by CodeRabbit