From cd2483d86b5c76ed8ea1fa1e1467fd35ff17635f Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 3 Feb 2026 22:05:12 +0300 Subject: [PATCH] fix(tenant): allow egress to vlogs in parent tenants Combine vminsert and vlogs egress rules using matchExpressions to reduce code duplication. This allows Fluent Bit in nested Kubernetes clusters to send logs to VLogs in parent tenants. Without this fix, logs from nested clusters timeout because Cilium blocks traffic to vlogs pods while metrics to vminsert work fine. Fixes #1970 Co-Authored-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/apps/tenant/templates/networkpolicy.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml index d9f87856..f01b1d36 100644 --- a/packages/apps/tenant/templates/networkpolicy.yaml +++ b/packages/apps/tenant/templates/networkpolicy.yaml @@ -46,13 +46,20 @@ spec: {{- $parts := splitList "-" .Release.Namespace }} {{- range $i, $v := $parts }} {{- if ne $i 0 }} - - matchLabels: - "k8s:app.kubernetes.io/name": "vminsert" - "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }} + - matchExpressions: + - key: "k8s:io.kubernetes.pod.namespace" + operator: "In" + values: + - {{ join "-" (slice $parts 0 (add $i 1)) | quote }} + - key: "k8s:app.kubernetes.io/name" + operator: "In" + values: + - "vminsert" + - "vlogs" {{- end }} {{- end }} {{- end }} - {{- end }} + {{- end }} {{- if ne (include "tenant.name" .) "tenant-root" }} - toEndpoints: {{- if hasPrefix "tenant-" .Release.Namespace }}