Skip to content

Update NetworkPolicy guidelines to reflect the correct namespace #1827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update NetworkPolicy guidelines to reflect the correct namespace #1827

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions content/docs/installation/best-practice.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,8 +104,7 @@ Here is an overview of the network requirements:
1. **TCP: ACME (Let's Encrypt) -> cert-manager (acmesolver)**:
If you use an ACME Issuer configured for HTTP01,
cert-manager will deploy an `acmesolver` Pod, a Service and an Ingress (or Gateway API) resource
in the namespace of the Issuer
or in the cert-manager namespace if it is a ClusterIssuer.
in the namespace of the Challenge resource.
Copy link

Copilot AI Nov 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] While technically correct, 'in the namespace of the Challenge resource' is somewhat circular. Consider clarifying this to 'in the same namespace as the Certificate resource' since Challenge resources are created in the same namespace as their parent Certificate, which is more immediately useful information for users planning network policies.

Suggested change
in the namespace of the Challenge resource.
in the same namespace as the Certificate resource.

Copilot uses AI. Check for mistakes.
Copy link
Author

@sztyup sztyup Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think this change would make it more clear, because the Certificate resource is not necessarily created by the user (Ingress, Gateway, etc.) or it may not even be created, if directly using CertificateRequest. I think the Challenge is the most appropriate for this documentation.

The ACME implementation will establish an HTTP connection to this Pod via your chosen ingress load balancer,
so your network policy must allow this.

Expand Down