Summary
#131 puts the per-node enforcement/observation/pods-matched answer into the status.nodes shard and derives the cluster-scoped conditions from the aggregate. That makes the truth available, but the only thing an operator sees at a glance is still the rolled-up Applied printer column:
NAME MODE APPLIED REASON AGE
block-ssh-egress enforce False EnforcementUnavailable
On a mixed cluster that says "something is wrong somewhere" and stops. The operator's actual question is which nodes, and answering it means reading status.nodes out of the YAML.
Ask
- A printer column carrying the ratio, so
kubectl get rpol distinguishes "no node can enforce this" from "three of forty cannot" — e.g. a NODES column reading 37/40.
- Per-node reasons legible in
kubectl describe, so the nodes that cannot enforce are named along with why.
Both are additive over whatever shard shape #131 settles on, which is why they are not in it.
Depends on
#131.
Summary
#131 puts the per-node enforcement/observation/pods-matched answer into the
status.nodesshard and derives the cluster-scoped conditions from the aggregate. That makes the truth available, but the only thing an operator sees at a glance is still the rolled-upAppliedprinter column:On a mixed cluster that says "something is wrong somewhere" and stops. The operator's actual question is which nodes, and answering it means reading
status.nodesout of the YAML.Ask
kubectl get rpoldistinguishes "no node can enforce this" from "three of forty cannot" — e.g. aNODEScolumn reading37/40.kubectl describe, so the nodes that cannot enforce are named along with why.Both are additive over whatever shard shape #131 settles on, which is why they are not in it.
Depends on
#131.