From 285ff755413afcb52bc93105ae3fe1b4888270ac Mon Sep 17 00:00:00 2001 From: Durgesh Bendale Date: Sun, 2 Aug 2026 21:02:39 +0530 Subject: [PATCH] OSDOCS-20898: Document NetworkPolicy whitelist for health probes in ambient mode In OSSM 3 ambient mode, the ztunnel proxy performs health checks on behalf of the kubelet using SNAT with the link-local IP 169.254.7.127. If a restrictive NetworkPolicy blocks this traffic, pod probes fail. This adds a module documenting the requirement to allow ingress from 169.254.7.127/32 in NetworkPolicy resources. Co-authored-by: Cursor --- ...m-ambient-networkpolicy-health-probes.adoc | 32 +++++++++++++++++++ .../v3x/ossm-service-mesh-3-0-overview.adoc | 4 ++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 modules/ossm-ambient-networkpolicy-health-probes.adoc diff --git a/modules/ossm-ambient-networkpolicy-health-probes.adoc b/modules/ossm-ambient-networkpolicy-health-probes.adoc new file mode 100644 index 000000000000..8c7f3637a0dd --- /dev/null +++ b/modules/ossm-ambient-networkpolicy-health-probes.adoc @@ -0,0 +1,32 @@ +//// +This module included in the following assemblies: +* service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc +//// +:_mod-docs-content-type: CONCEPT +[id="ossm-ambient-networkpolicy-health-probes_{context}"] += Configuring network policies for health probes in ambient mode + +In {SMProductName} 3 ambient mode, when OVN-Kubernetes local gateway mode is enabled (`routingViaHost: true`), the ztunnel proxy performs health checks on behalf of the kubelet by using source network address translation (SNAT) with the link-local IP address `169.254.7.127`. + +If you apply a restrictive `NetworkPolicy` resource, such as a deny-all ingress policy, to a namespace enrolled in the ambient mesh, the ztunnel health probe traffic is blocked. This causes pod startup, readiness, or liveness probe failures. + +To allow health probes to function, you must add an ingress rule that permits traffic from `169.254.7.127/32` in your `NetworkPolicy` resource: + +[source,yaml] +---- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-ambient-health-probes +spec: + podSelector: {} + ingress: + - from: + - ipBlock: + cidr: 169.254.7.127/32 +---- + +[NOTE] +==== +On dual-stack or IPv6-only clusters, also allow the IPv6 address `fd16:9254:7127:1337:ffff:ffff:ffff:ffff/128`. +==== diff --git a/service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc b/service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc index 0f4dcd388ff1..3e2c7312ec03 100644 --- a/service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc +++ b/service_mesh/v3x/ossm-service-mesh-3-0-overview.adoc @@ -11,4 +11,6 @@ toc::[] [NOTE] ==== Because {SMProductName} 3.0 releases on a different cadence from {product-title}, the {SMProductShortName} documentation is available as a separate documentation set at link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh[{SMProductName}]. -==== \ No newline at end of file +==== + +include::modules/ossm-ambient-networkpolicy-health-probes.adoc[leveloffset=+1] \ No newline at end of file