Conversation
Pin the kind CLI instead of relying on the runner-provided binary. kind v0.32.0 publishes the Kubernetes v1.36.1 node image and also updates containerd handling. The release notes state that newly published node images require kind v0.32.0+ for kind load to work reliably. This project uses kind load docker-image in CI and local test flows, so the kind binary and the default node image need to be kept in sync. Previously the Makefile used whatever kind happened to be on PATH, which made CI depend on the GitHub runner image. Installing the pinned binary under build/tools/bin makes the behavior reproducible and prevents an older ambient kind binary from being used with newer node images.
Kubernetes 1.36 rejects generated NetworkPolicy ipBlock CIDRs such as 172.18.0.3/24 because strict CIDR validation requires canonical network addresses. Use host-scoped /32 CIDRs for the API server endpoint and service IP so the operator-to-apiserver-egress policy applies after deny-all is installed. Also make the API-server policy egress-only and remove stale allow-webhook-ingress-from-all references left after webhook removal.
oracle-contributor-agreement
Bot
added
the
OCA Verified
fryp
approved these changes
Jun 24, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/32API server CIDRs.Details
The kind Makefile targets now install and use the project-pinned kind binary from
build/tools/bin, avoiding reliance on the runner-providedkindversion. This keepskind load docker-imagebehavior aligned with the newer node images used by local and CI test flows.
The network policy example now keeps the API server allow policy egress-only, removes stale webhook policy references, and generates canonical
/32CIDRs so Kubernetes 1.36 accepts the resultingNetworkPolicy resources.