diff --git a/deploy/eck-operator/templates/statefulset.yaml b/deploy/eck-operator/templates/statefulset.yaml index 5c1fd034d0..4358e5f92c 100644 --- a/deploy/eck-operator/templates/statefulset.yaml +++ b/deploy/eck-operator/templates/statefulset.yaml @@ -117,6 +117,10 @@ spec: {{- with .Values.volumes }} {{- toYaml . | nindent 8 }} {{- end }} + {{- if .Values.webhook.hostNetwork }} + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 12 }} diff --git a/deploy/eck-operator/values.yaml b/deploy/eck-operator/values.yaml index aa2ddd2f81..fba1f672cf 100644 --- a/deploy/eck-operator/values.yaml +++ b/deploy/eck-operator/values.yaml @@ -119,6 +119,10 @@ webhook: # objectSelector corresponds to the objectSelector property of the webhook. # Setting this restricts the webhook to act only on objects that match the selector. objectSelector: {} + # HostNetwork allows a Pod to use the Node network namespace. + # This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled. + # CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host. + hostNetwork: false softMultiTenancy: # enabled determines whether the operator is installed with soft multi-tenancy extensions. @@ -235,4 +239,3 @@ global: createOperatorNamespace: true # kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml. kubeVersion: 1.21.0 -