Proper way to configure Calico Whisker for Ingress exposure?

[ViliusS]

I'm trying to expose Calico Whisker through Ingress-NGINX load balancer instead of port forwarding. I've done the ingress part, but I've stumbled upon default Network Policy which forbids traffic from the Ingress-NGINX to reach port 8081.

I have tried to modify default whisker Network Policy which I assume is managed by the operator, however it get's overwritten after few seconds. To workaround this issue I have created an additional Network Policy object:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: whisker-ingress
  namespace: calico-system
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          projectcalico.org/name: ingress-nginx
      podSelector:
        matchLabels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/name: ingress-nginx
    ports:
    - port: 8081
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/name: whisker
  policyTypes:
  - Ingress

Is this the correct way to expose Whisker through Ingress-NGINX load balancer or is there any way to configure default Network Policy through operator using operator.tigera.io/v1 kind: Whisker CRD?

[caseydavenport]

@ViliusS yep! What you've done is how it was intended to work. NetworkPolicies are additive, so simply adding a network policy that allows the traffic you need will do the trick.

[ViliusS]

Thank you for your answer.

I would hope that we will be able to configure ingress using custom CRDs, though :)

[caseydavenport]

@ViliusS would you be interesting in opening an enhancement request and outline precisely what you're looking for? That will help us track

https://github.com/projectcalico/calico/issues/new?template=generate-purpose-issue-template.md

[ViliusS]

Done #10405