Description

Summary

Update the Sidecar Injector and Pod Reconciler components in the control plane to implement the new way of configuring the transparent proxy as described in the MADR Transparent Proxy ConfigMap Handling Outside the Control Plane. This includes generating the config from merged sources, applying annotations, setting up Downward API and ConfigMap mounts, and removing the need for the control plane to access ConfigMaps in all namespaces.

Background

Previously, the control plane was responsible for assembling the full transparent proxy configuration and required access to ConfigMaps across all namespaces. With the new approach, each data plane component (kuma-init, kuma-sidecar) will build its own configuration from mounted sources. The control plane will now only handle setting the correct annotations and mounts during sidecar injection.

Tasks

• In the Sidecar Injector:
  • Merge default config from control plane settings and the kuma-system ConfigMap
  • Apply any Pod-level transparent proxy annotations
  • Compute only the delta from defaults
  • Inject the traffic.kuma.io/transparent-proxy-config annotation
  • Add a downward API volume for the annotation mounted as /tmp/transparent-proxy/default/config.yaml
  • If traffic.kuma.io/transparent-proxy-configmap-name is present, mount the specified ConfigMap at /tmp/transparent-proxy/custom/config.yaml
  • Add CLI args for --transparent-proxy-config to kuma-sidecar and --config to kuma-init
• In the Pod Reconciler:
  • Stop setting transparent proxy fields in the Dataplane resource
• Remove ClusterRole permissions that allow the control plane to access ConfigMaps in all namespaces
• Add tests for expected Pod spec output based on merged configuration

Acceptance Criteria

• Sidecar injection produces a Pod spec like the example shown in the MADR:
  • Includes the traffic.kuma.io/transparent-proxy-config annotation with computed values
  • Mounts the annotation and any referenced ConfigMap as files in /tmp/transparent-proxy
  • CLI flags --transparent-proxy-config=/tmp/transparent-proxy/default/config.yaml and --transparent-proxy-config=/tmp/transparent-proxy/custom/config.yaml are present
• Pod Reconciler no longer uses or sets redirectPortInbound, redirectPortOutbound, or ipFamilyMode in the Dataplane resource
• ClusterRole used by the control plane no longer includes access to ConfigMaps in * namespaces