policy: Make global egress network namespace configurable

charts/linkerd-control-plane/README.md

@@ -166,6 +166,7 @@ Kubernetes: `>=1.22.0-0`
 | destinationController.readinessProbe.timeoutSeconds | int | `1` |  |
 | disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob |
 | disableIPv6 | bool | `true` | disables routing IPv6 traffic in addition to IPv4 traffic through the proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni v1.4.0) |
+| egress.globalEgressNetworkNamespace | string | `"linkerd-egress"` | The namespace that is used to store egress configuration that affects all client workloads in the cluster |
 | enableEndpointSlices | bool | `true` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on |
 | enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |

charts/linkerd-control-plane/templates/destination.yaml

@@ -348,6 +348,7 @@ spec:
         - --log-level={{.Values.policyController.logLevel | default "linkerd=info,warn"}}
         - --log-format={{.Values.controllerLogFormat}}
         - --default-opaque-ports={{.Values.proxy.opaquePorts}}
+        - --global-egress-network-namespace={{.Values.egress.globalEgressNetworkNamespace}}
         {{- if .Values.policyController.probeNetworks }}
         - --probe-networks={{.Values.policyController.probeNetworks | join ","}}
         {{- end}}

charts/linkerd-control-plane/values.yaml

@@ -662,3 +662,10 @@ podMonitor:
   proxy:
     # -- Enables the creation of PodMonitor for the data-plane
     enabled: true
+
+
+# Egress related configuration
+egress:
+  # -- The namespace that is used to store egress configuration that affects all client workloads in the cluster
+  globalEgressNetworkNamespace: linkerd-egress
+

charts/linkerd-crds/README.md

@@ -66,6 +66,8 @@ Kubernetes: `>=1.22.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | enableHttpRoutes | bool | `true` |  |
+| enableTcpRoutes | bool | `true` |  |
+| enableTlsRoutes | bool | `true` |  |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0)

cli/cmd/install_test.go

@@ -161,6 +161,7 @@ func TestRender(t *testing.T) {
 		ProxyInjector:      defaultValues.ProxyInjector,
 		ProfileValidator:   defaultValues.ProfileValidator,
 		PolicyValidator:    defaultValues.PolicyValidator,
+		Egress:             defaultValues.Egress,
 	}
 
 	haValues, err := testInstallOptionsHA(true)

pkg/charts/linkerd2/values.go

@@ -89,6 +89,12 @@ type (
 		DestinationProxyResources   *Resources `json:"destinationProxyResources"`
 		IdentityProxyResources      *Resources `json:"identityProxyResources"`
 		ProxyInjectorProxyResources *Resources `json:"proxyInjectorProxyResources"`
+		Egress                      *Egress    `json:"egress"`
+	}
+
+	// Resources represents the computational resources setup for a given container
+	Egress struct {
+		GlobalEgressNetworkNamespace string `json:"globalEgressNetworkNamespace"`
 	}
 
 	// Controller contains the fields to set the controller container

pkg/charts/linkerd2/values_test.go

@@ -249,6 +249,7 @@ func TestNewValues(t *testing.T) {
 		ProxyInjector:    &ProxyInjector{Webhook: Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorInjector}},
 		ProfileValidator: &Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorSimple},
 		PolicyValidator:  &Webhook{TLS: &TLS{}, NamespaceSelector: namespaceSelectorSimple},
+		Egress:           &Egress{GlobalEgressNetworkNamespace: "linkerd-egress"},
 	}
 
 	// pin the versions to ensure consistent test result.

policy-controller/k8s/index/src/cluster_info.rs

@@ -35,7 +35,7 @@ pub struct ClusterInfo {
 
     /// The namespace that is designated for egress configuration
     /// affecting all workloads across the cluster
-    pub global_external_network_namespace: Arc<String>,
+    pub global_egress_network_namespace: Arc<String>,
 }
 
 impl ClusterInfo {