OSDOCS-20898: Document NetworkPolicy whitelist for health probes in ambient mode

[Durgesh-Bendale]

Summary

Fixes https://redhat.atlassian.net/browse/OSDOCS-20898

In OSSM 3 ambient mode, when OVN-Kubernetes local gateway mode is enabled
(routingViaHost: true), the ztunnel proxy performs health checks on behalf
of the kubelet using SNAT with the link-local IP 169.254.7.127. If a
restrictive NetworkPolicy (e.g. deny-all ingress) is applied to a namespace
enrolled in the ambient mesh, health probe traffic is blocked, causing pod
startup, readiness, or liveness probe failures.

This PR adds a new module documenting the requirement to allow ingress from
169.254.7.127/32 in NetworkPolicy resources.

Versions: OSSM 3.0+

What changed

• New module: modules/ossm-ambient-networkpolicy-health-probes.adoc
• Modified assembly: service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc
  (added include for the new module)

References

• Upstream: https://istio.io/latest/docs/ambient/usage/networkpolicy/
• Related issue: Wrong iptables backend chosen sometimes with ambient on OpenShift istio/istio#56983

Test plan

• Verify the new module renders correctly in the Netlify preview
• Confirm the YAML example is valid

Made with Cursor

[openshift-ci-robot]

@Durgesh-Bendale: This pull request references OSDOCS-20898 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Fixes https://redhat.atlassian.net/browse/OSDOCS-20898

In OSSM 3 ambient mode, when OVN-Kubernetes local gateway mode is enabled
(routingViaHost: true), the ztunnel proxy performs health checks on behalf
of the kubelet using SNAT with the link-local IP 169.254.7.127. If a
restrictive NetworkPolicy (e.g. deny-all ingress) is applied to a namespace
enrolled in the ambient mesh, health probe traffic is blocked, causing pod
startup, readiness, or liveness probe failures.

This PR adds a new module documenting the requirement to allow ingress from
169.254.7.127/32 in NetworkPolicy resources.

Versions: OSSM 3.0+

What changed

• New module: modules/ossm-ambient-networkpolicy-health-probes.adoc
• Modified assembly: service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc
  (added include for the new module)

References

• Upstream: https://istio.io/latest/docs/ambient/usage/networkpolicy/
• Related issue: Wrong iptables backend chosen sometimes with ambient on OpenShift istio/istio#56983

Test plan

• Verify the new module renders correctly in the Netlify preview
• Confirm the YAML example is valid

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hi @Durgesh-Bendale. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.