Repository: linkerd/linkerd2
Pull request #6834 (2021-09-07 23:50:12)

Update linkerd-await to v0.2.4
This release includes dependency updates and no longer emits an error
message when linkerd-await is disabled.

<!--  Thanks for sending a pull request!

If you already have a well-structured git commit message, chances are GitHub
set the title and description of this PR to the git commit message subject and
body, respectively. If so, you may delete these instructions and submit your PR.

If this is your first time, please read our contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md

The title and description of your Pull Request should match the git commit
subject and body, respectively. Git commit messages are structured as follows:

```
Subject

Problem

Solution

Validation

Fixes #[GitHub issue ID]

DCO Sign off
```

Example git commit message:

```
Introduce Pull Request Template

GitHub's community guidelines recommend a pull request template, the repo was
lacking one.

Introduce a `PULL_REQUEST_TEMPLATE.md` file.

Once merged, the
[Community profile checklist](https://github.com/linkerd/linkerd2/community)
should indicate the repo now provides a pull request template.

Fixes #3321

Signed-off-by: Jane Smith <jane.smith@example.com>
```

Note the git commit message subject becomes the pull request title.

For more details around git commits, see the section on Committing in our
contributor guide:
https://github.com/linkerd/linkerd2/blob/main/CONTRIBUTING.md#committing
-->



Patch:
diff --git a/Dockerfile-proxy b/Dockerfile-proxy
index 2f552065d..281d8b88e 100644
--- a/Dockerfile-proxy
+++ b/Dockerfile-proxy
@@ -17,7 +17,7 @@ COPY .proxy-version proxy-version
 ARG TARGETARCH
 RUN (proxy=$(bin/fetch-proxy $(cat proxy-version) $TARGETARCH) && \
     mv "$proxy" linkerd2-proxy)
-ARG LINKERD_AWAIT_VERSION=v0.2.3
+ARG LINKERD_AWAIT_VERSION=v0.2.4
 RUN curl -fsSvLo linkerd-await https://github.com/linkerd/linkerd-await/releases/download/release%2F${LINKERD_AWAIT_VERSION}/linkerd-await-${LINKERD_AWAIT_VERSION}-${TARGETARCH} && chmod +x linkerd-await
 
 ## compile proxy-identity agent
diff --git a/charts/linkerd2/templates/destination-rbac.yaml b/charts/linkerd2/templates/destination-rbac.yaml
index da17368be..8117fcef2 100644
--- a/charts/linkerd2/templates/destination-rbac.yaml
+++ b/charts/linkerd2/templates/destination-rbac.yaml
@@ -169,7 +169,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/policy-controller/k8s/api/src/lib.rs b/policy-controller/k8s/api/src/lib.rs
index 6e53f7e05..ed6e09e85 100644
--- a/policy-controller/k8s/api/src/lib.rs
+++ b/policy-controller/k8s/api/src/lib.rs
@@ -20,7 +20,6 @@ use tracing::info_span;
 
 /// Resource watches.
 pub struct ResourceWatches {
-    pub nodes_rx: Watch<Node>,
     pub pods_rx: Watch<Pod>,
     pub servers_rx: Watch<policy::Server>,
     pub authorizations_rx: Watch<policy::ServerAuthorization>,
@@ -45,8 +44,6 @@ impl From<kube::Client> for ResourceWatches {
         let pod_params = params.clone().labels("linkerd.io/control-plane-ns");
 
         Self {
-            nodes_rx: Watch::from(watcher(Api::all(client.clone()), params.clone()))
-                .instrument(info_span!("nodes")),
             pods_rx: Watch::from(watcher(Api::all(client.clone()), pod_params))
                 .instrument(info_span!("pods")),
             servers_rx: Watch::from(watcher(Api::all(client.clone()), params.clone()))
diff --git a/policy-controller/k8s/index/src/authz.rs b/policy-controller/k8s/index/src/authz.rs
index 47eb1b040..6b2713d47 100644
--- a/policy-controller/k8s/index/src/authz.rs
+++ b/policy-controller/k8s/index/src/authz.rs
@@ -202,6 +202,7 @@ fn mk_authz(
             })
             .collect::<Result<Vec<NetworkMatch>>>()?
     } else {
+        // If no networks are specified, the cluster networks are used as the default.
         cluster_networks
             .iter()
             .copied()
diff --git a/policy-controller/k8s/index/src/lib.rs b/policy-controller/k8s/index/src/lib.rs
index 0dfabb984..88ccf2795 100644
--- a/policy-controller/k8s/index/src/lib.rs
+++ b/policy-controller/k8s/index/src/lib.rs
@@ -3,8 +3,6 @@
 //! The policy controller serves discovery requests from inbound proxies, indicating how the proxy
 //! should admit connections into a Pod. It watches the following cluster resources:
 //!
-//! - A `Node`'s `podCIDRs` field can be used to determine the IP of the node's Kubelet instance.
-//!   Traffic is always permitted to a pod from its Kubelet's IP.
 //! - A `Namespace` may be annotated with a default-allow policy that applies to all pods in the
 //!   namespace (unless they are annotated with a default policy).
 //! - Each `Pod` enumerate its ports. We maintain an index of each pod's ports, linked to `Server`
@@ -15,8 +13,7 @@
 //!   their authorizations and publishes these updates on the server's broadcast channel.
 //!
 //! ```text
-//! [Node] <- [ Pod ]
-//!           |-> [ Port ] <- [ Server ] <- [ ServerAuthorization ]
+//! [ Pod ] -> [ Port ] <- [ Server ] <- [ ServerAuthorization ]
 //! ```
 //!
 //! Lookups against this index are are initiated for a single pod & port. The pod-port's state is
@@ -34,7 +31,6 @@ mod authz;
 mod defaults;
 mod lookup;
 mod namespace;
-mod node;
 mod pod;
 mod server;
 #[cfg(test)]
@@ -44,12 +40,11 @@ pub use self::{defaults::DefaultPolicy, lookup::Reader};
 use self::{
     defaults::DefaultPolicyWatches,
     namespace::{Namespace, NamespaceIndex},
-    node::NodeIndex,
     server::SrvIndex,
 };
 use anyhow::Context;
 use linkerd_policy_controller_core::{InboundServer, IpNet};
-use linkerd_policy_controller_k8s_api::{self as k8s, ResourceExt};
+use linkerd_policy_controller_k8s_api::{self as k8s};
 use tokio::{sync::watch, time};
 use tracing::{debug, warn};
 
@@ -71,9 +66,6 @@ pub struct Index {
     /// Holds per-namespace pod/server/authorization indexes.
     namespaces: NamespaceIndex,
 
-    /// Cached Node IPs.
-    nodes: NodeIndex,
-
     /// The cluster's mesh identity trust domain.
     identity_domain: String,
 
@@ -119,7 +111,6 @@ impl Index {
             identity_domain,
             cluster_networks,
             default_policy_watches,
-            nodes: NodeIndex::default(),
         };
         (reader, idx)
     }
@@ -137,7 +128,6 @@ impl Index {
         ready_tx: watch::Sender<bool>,
     ) {
         let k8s::ResourceWatches {
-            mut nodes_rx,
             mut pods_rx,
             mut servers_rx,
             mut authorizations_rx,
@@ -146,13 +136,6 @@ impl Index {
         let mut initialized = false;
         loop {
             let res = tokio::select! {
-                // Track the kubelet IPs for all nodes.
-                up = nodes_rx.recv() => match up {
-                    k8s::Event::Applied(node) => self.apply_node(node).context("applying a node"),
-                    k8s::Event::Deleted(node) => self.delete_node(&node.name()).context("deleting a node"),
-                    k8s::Event::Restarted(nodes) => self.reset_nodes(nodes).context("resetting nodes"),
-                },
-
                 // Track pods against the appropriate server.
                 up = pods_rx.recv() => match up {
                     k8s::Event::Applied(pod) => self.apply_pod(pod).context("applying a pod"),
@@ -187,7 +170,6 @@ impl Index {
 
             // Notify the readiness watch once all watches have updated.
             if !initialized
-                && nodes_rx.is_initialized()
                 && pods_rx.is_initialized()
                 && servers_rx.is_initialized()
                 && authorizations_rx.is_initialized()
diff --git a/policy-controller/k8s/index/src/lookup.rs b/policy-controller/k8s/index/src/lookup.rs
index ccd137f5c..356c2a18b 100644
--- a/policy-controller/k8s/index/src/lookup.rs
+++ b/policy-controller/k8s/index/src/lookup.rs
@@ -1,11 +1,8 @@
-use crate::{node::KubeletIps, PodServerRx};
+use crate::PodServerRx;
 use anyhow::{anyhow, Result};
 use dashmap::{mapref::entry::Entry, DashMap};
-use linkerd_policy_controller_core::{
-    ClientAuthentication, ClientAuthorization, DiscoverInboundServer, InboundServer,
-    InboundServerStream, NetworkMatch,
-};
-use std::{collections::HashMap, net::IpAddr, sync::Arc};
+use linkerd_policy_controller_core::{DiscoverInboundServer, InboundServer, InboundServerStream};
+use std::{collections::HashMap, sync::Arc};
 
 #[derive(Debug, Default)]
 pub(crate) struct Writer(ByNs);
@@ -30,8 +27,6 @@ pub(crate) fn pair() -> (Writer, Reader) {
 /// Represents a pod server's configuration.
 #[derive(Clone, Debug)]
 pub struct Rx {
-    kubelet: KubeletIps,
-
     /// A watch of server watches.
     rx: PodServerRx,
 }
@@ -118,19 +113,16 @@ impl DiscoverInboundServer<(String, String, u16)> for Reader {
 // === impl Rx ===
 
 impl Rx {
-    pub(crate) fn new(kubelet: KubeletIps, rx: PodServerRx) -> Self {
-        Self { kubelet, rx }
+    pub(crate) fn new(rx: PodServerRx) -> Self {
+        Self { rx }
     }
 
     pub(crate) fn get(&self) -> InboundServer {
-        Self::mk_server(&*self.kubelet, (*(*self.rx.borrow()).borrow()).clone())
+        (*self.rx.borrow().borrow()).clone()
     }
 
     /// Streams server configuration updates.
     pub(crate) fn into_stream(self) -> InboundServerStream {
-        // The kubelet IPs for a pod cannot change at runtime.
-        let kubelet = self.kubelet;
-
         // Watches server watches. This watch is updated as `Server` resources are created/deleted
         // (or modified to select/deselect a pod-port).
         let mut pod_port_rx = self.rx;
@@ -142,7 +134,7 @@ impl Rx {
         Box::pin(async_stream::stream! {
             // Get the initial server state and publish it.
             let mut server = (*server_rx.borrow_and_update()).clone();
-            yield Self::mk_server(&*kubelet, server.clone());
+            yield server.clone();
 
             loop {
                 tokio::select! {
@@ -152,7 +144,7 @@ impl Rx {
                         if res.is_ok() {
                             let s = (*server_rx.borrow()).clone();
                             if s != server {
-                                yield Self::mk_server(&*kubelet, s.clone());
+                                yield s.clone();
                                 server = s;
                             }
                         }
@@ -168,7 +160,7 @@ impl Rx {
                         server_rx = (*pod_port_rx.borrow()).clone();
                         let s = (*server_rx.borrow_and_update()).clone();
                         if s != server {
-                            yield Self::mk_server(&*kubelet, s.clone());
+                            yield s.clone();
                             server = s;
                         }
                     },
@@ -176,16 +168,4 @@ impl Rx {
             }
         })
     }
-
-    #[inline]
-    fn mk_server(kubelet: &[IpAddr], mut inner: InboundServer) -> InboundServer {
-        let networks = kubelet.iter().copied().map(NetworkMatch::from).collect();
-        let authz = ClientAuthorization {
-            networks,
-            authentication: ClientAuthentication::Unauthenticated,
-        };
-
-        inner.authorizations.insert("default:kubelet".into(), authz);
-        inner
-    }
 }
diff --git a/policy-controller/k8s/index/src/node.rs b/policy-controller/k8s/index/src/node.rs
deleted file mode 100644
index 358a6aa9e..000000000
--- a/policy-controller/k8s/index/src/node.rs
+++ /dev/null
@@ -1,228 +0,0 @@
-//! Node->Kubelet IP
-
-use crate::{Errors, Index};
-use anyhow::{anyhow, Context, Result};
-use linkerd_policy_controller_core::IpNet;
-use linkerd_policy_controller_k8s_api::{self as k8s, ResourceExt};
-use std::{
-    collections::{hash_map::Entry as HashEntry, HashMap, HashSet},
-    net::IpAddr,
-    sync::Arc,
-};
-use tracing::{debug, instrument, trace, warn};
-
-/// Stores the Kubelet IP addresses for each node.
-///
-/// If a pod is observed before its node is observed, then the pod is stored instead so that, once
-/// the node IP is observed, the pod index may be back-filled.
-#[derive(Debug, Default)]
-pub(crate) struct NodeIndex {
-    index: HashMap<String, State>,
-}
-
-#[derive(Debug)]
-enum State {
-    Pending(HashMap<String, HashMap<String, k8s::Pod>>),
-    Known(KubeletIps),
-}
-
-#[derive(Clone, Debug, Hash, PartialEq, Eq)]
-pub(crate) struct KubeletIps(Arc<[IpAddr]>);
-
-// === impl NodeIndex ===
-
-impl NodeIndex {
-    /// Attempts to get a pod's kubelet IP address.
-    ///
-    /// If the node has not yet been observed, `None` is returned and the pod is stored to be
-    /// indexed once the node is observed.
-    pub fn get_kubelet_ips_or_push_pending(
-        &mut self,
-        pod: k8s::Pod,
-    ) -> Option<(k8s::Pod, KubeletIps)> {
-        let node_name = pod.spec.as_ref()?.node_name.clone()?;
-        match self.index.entry(node_name) {
-            HashEntry::Occupied(mut entry) => {
-                debug!(node = %entry.key(), state = ?entry.get(), "Found");
-                match entry.get_mut() {
-                    State::Known(ips) => Some((pod, ips.clone())),
-                    State::Pending(pods) => {
-                        pods.entry(pod.namespace()?)
-                            .or_default()
-                            .insert(pod.name(), pod);
-                        None
-                    }
-                }
-            }
-            HashEntry::Vacant(entry) => {
-                debug!(node = %entry.key(), "Missing");
-                let ns = pod.namespace()?;
-                let name = pod.name();
-                entry.insert(State::Pending(
-                    Some((ns, Some((name, pod)).into_iter().collect()))
-                        .into_iter()
-                        .collect(),
-                ));
-                None
-            }
-        }
-    }
-
-    pub fn clear_pending_pod(&mut self, ns: &str, pod: &str) -> bool {
-        for state in self.index.values_mut() {
-            if let State::Pending(by_ns) = state {
-                if let Some(pods) = by_ns.get_mut(ns) {
-                    if pods.remove(pod).is_some() {
-                        return true;
-                    }
-                }
-            }
-        }
-
-        false
-    }
-
-    pub fn clear_pending_pods(&mut self) {
-        self.index
-            .retain(|_, state| matches!(state, State::Known(_)))
-    }
-}
-
-// === impl Index ===
-
-impl Index {
-    /// Tracks the kubelet IP for each node.
-    ///
-    /// As pods are we created, we refer to the node->kubelet index to automatically allow traffic
-    /// from the kubelet.
-    #[instrument(
-        skip(self, node),
-        fields(name = %node.name())
-    )]
-    pub fn apply_node(&mut self, node: k8s::Node) -> Result<()> {
-        match self.nodes.index.entry(node.name()) {
-            HashEntry::Vacant(entry) => {
-                let ips = KubeletIps::try_from_node(node)
-                    .with_context(|| format!("failed to load kubelet IPs for {}", entry.key()))?;
-                debug!(?ips, "Adding");
-                entry.insert(State::Known(ips));
-                Ok(())
-            }
-
-            HashEntry::Occupied(mut entry) => {
-                // If the node is already configured, ignore the update.
-                if let State::Known(_) = entry.get() {
-                    trace!("Already existed");
-                    return Ok(());
-                }
-
-                // Otherwise, the update is replacing a set of pending pods. Update the state to the
-                // known set of IPs and then apply all of the pending pods.
-                let ips = KubeletIps::try_from_node(node)
-                    .with_context(|| format!("failed to load kubelet IPs for {}", entry.key()))?;
-                debug!(?ips, "Adding");
-                let pods = match std::mem::replace(entry.get_mut(), State::Known(ips)) {
-                    State::Pending(pods) => pods,
-                    State::Known(_) => unreachable!("the node state must have been pending"),
-                };
-
-                let mut errors = vec![];
-                for (_, by_ns) in pods.into_iter() {
-                    for (_, pod) in by_ns.into_iter() {
-                        if let Err(e) = self.apply_pod(pod) {
-                            errors.push(e)
-                        }
-                    }
-                }
-
-                Errors::ok_if_empty(errors)
-            }
-        }
-    }
-
-    #[instrument(skip(self))]
-    pub fn delete_node(&mut self, name: &str) -> Result<()> {
-        self.nodes
-            .index
-            .remove(name)
-            .ok_or_else(|| anyhow!("node {} does not exist", name))?;
-        debug!("Deleted");
-        Ok(())
-    }
-
-    #[instrument(skip(self, nodes))]
-    pub fn reset_nodes(&mut self, nodes: Vec<k8s::Node>) -> Result<()> {
-        // Avoid rebuilding data for nodes that have not changed.
-        let mut prior = self
-            .nodes
-            .index
-            .iter()
-            .filter_map(|(name, state)| match state {
-                State::Known(_) => Some(name.clone()),
-                State::Pending(_) => None,
-            })
-            .collect::<HashSet<_>>();
-
-        let mut errors = vec![];
-        for node in nodes.into_iter() {
-            let name = node.name();
-            if prior.remove(&name) {
-                trace!(%name, "Already existed");
-            } else if let Err(error) = self.apply_node(node) {
-                warn!(%name, %error, "Failed to apply node");
-                errors.push(error);
-            }
-        }
-
-        for name in prior.into_iter() {
-            debug!(?name, "Removing defunct node");
-            let removed = self.nodes.index.remove(&name).is_some();
-            debug_assert!(removed, "node must be removable");
-            if !removed {
-                warn!(%name, "Failed to apply node");
-                errors.push(anyhow!("node {} already removed", name));
-            }
-        }
-
-        Errors::ok_if_empty(errors)
-    }
-}
-
-// === impl KubeletIps ===
-
-impl std::ops::Deref for KubeletIps {
-    type Target = [IpAddr];
-
-    fn deref(&self) -> &[IpAddr] {
-        &*self.0
-    }
-}
-
-impl KubeletIps {
-    fn try_from_cidr(cidr: String) -> Result<IpAddr> {
-        cidr.parse::<IpNet>()
-            .with_context(|| format!("invalid CIDR {}", cidr))?
-            .hosts()
-            .next()
-            .ok_or_else(|| anyhow!("pod CIDR network is empty"))
-    }
-
-    fn try_from_node(node: k8s::Node) -> Result<Self> {
-        let spec = node.spec.ok_or_else(|| anyhow!("node missing spec"))?;
-
-        let addrs = if let Some(cidrs) = spec.pod_cidrs {
-            cidrs
-                .into_iter()
-                .map(Self::try_from_cidr)
-                .collect::<Result<Vec<_>>>()?
-        } else {
-            let cidr = spec
-                .pod_cidr
-                .ok_or_else(|| anyhow!("node missing pod_cidr"))?;
-            let ip = Self::try_from_cidr(cidr)?;
-            vec![ip]
-        };
-
-        Ok(Self(addrs.into()))
-    }
-}
diff --git a/policy-controller/k8s/index/src/pod.rs b/policy-controller/k8s/index/src/pod.rs
index 037689f52..59c2f90a0 100644
--- a/policy-controller/k8s/index/src/pod.rs
+++ b/policy-controller/k8s/index/src/pod.rs
@@ -1,6 +1,6 @@
 use crate::{
-    defaults::PortDefaults, lookup, node::KubeletIps, DefaultPolicy, DefaultPolicyWatches, Errors,
-    Index, Namespace, NodeIndex, PodServerTx, ServerRx, SrvIndex,
+    defaults::PortDefaults, lookup, DefaultPolicy, DefaultPolicyWatches, Errors, Index, Namespace,
+    PodServerTx, ServerRx, SrvIndex,
 };
 use anyhow::{anyhow, bail, Context, Result};
 use linkerd_policy_controller_k8s_api::{self as k8s, policy, ResourceExt};
@@ -64,7 +64,7 @@ struct Port {
 // === impl Index ===
 
 impl Index {
-    /// Creates or updates a `Pod`, linking it with servers and nodes.
+    /// Creates or updates a `Pod`, linking it with servers.
     #[instrument(
         skip(self, pod),
         fields(
@@ -84,7 +84,6 @@ impl Index {
 
         pods.apply(
             pod,
-            &mut self.nodes,
             servers,
             &mut self.lookups,
             *default_policy,
@@ -107,8 +106,6 @@ impl Index {
 
     #[instrument(skip(self, pods))]
     pub(crate) fn reset_pods(&mut self, pods: Vec<k8s::Pod>) -> Result<()> {
-        self.nodes.clear_pending_pods();
-
         let mut prior_pods = self
             .namespaces
             .iter()
@@ -142,12 +139,6 @@ impl Index {
     }
 
     fn rm_pod(&mut self, ns: &str, pod: &str) -> Result<()> {
-        if self.nodes.clear_pending_pod(ns, pod) {
-            // If the pod was pending that it can't be in the main index.
-            debug!("Cleared pending pod");
-            return Ok(());
-        }
-
         self.namespaces
             .index
             .get_mut(ns)
@@ -194,7 +185,6 @@ impl PodIndex {
     fn apply(
         &mut self,
         pod: k8s::Pod,
-        nodes: &mut NodeIndex,
         servers: &SrvIndex,
         lookups: &mut lookup::Writer,
         default_policy: DefaultPolicy,
@@ -204,17 +194,6 @@ impl PodIndex {
         let pod_name = pod.name();
         match self.index.entry(pod_name) {
             HashEntry::Vacant(pod_entry) => {
-                // Lookup the pod's node's kubelet IP or stop processing the update. If the pod does
-                // not yet have a node, it will be ignored. If the node isn't yet in the index, the
-                // pod is saved to be processed later.
-                let (pod, kubelet) = match nodes.get_kubelet_ips_or_push_pending(pod) {
-                    Some((pod, ips)) => (pod, ips),
-                    None => {
-                        debug!("Pod cannot yet be assigned to a Node");
-                        return Ok(());
-                    }
-                };
-
                 let spec = pod.spec.ok_or_else(|| anyhow!("pod missing spec"))?;
 
                 // Check the pod for a default-allow annotation. If it's set, use it; otherwise use
@@ -238,7 +217,6 @@ impl PodIndex {
                     &pod_annotations,
                     default_policy,
                     default_policy_watches,
-                    kubelet,
                 );
 
                 // Start tracking the pod's metadata so it can be linked against servers as they are
@@ -288,7 +266,6 @@ impl PodIndex {
         annotations: &PodAnnotations,
         default_policy: DefaultPolicy,
         default_policy_watches: &mut DefaultPolicyWatches,
-        kubelet: KubeletIps,
     ) -> (PodPorts, HashMap<u16, lookup::Rx>) {
         let mut ports = PodPorts::default();
         let mut lookups = HashMap::new();
@@ -317,7 +294,7 @@ impl PodIndex {
                     }
 
                     ports.by_port.insert(port, pod_port);
-                    lookups.insert(port, lookup::Rx::new(kubelet.clone(), rx));
+                    lookups.insert(port, lookup::Rx::new(rx));
                 }
             }
         }
diff --git a/web/app/package.json b/web/app/package.json
index 4637b3086..3b80399f5 100644
--- a/web/app/package.json
+++ b/web/app/package.json
@@ -81,7 +81,7 @@
     "webpack": "^5.52.0",
     "webpack-bundle-analyzer": "4.4.2",
     "webpack-cli": "4.8.0",
-    "webpack-dev-server": "4.1.0"
+    "webpack-dev-server": "4.1.1"
   },
   "resolutions": {
     "@lingui/**/**/minimist": ">=1.2.5",
diff --git a/web/app/yarn.lock b/web/app/yarn.lock
index 5b096b6f0..3647d7b9f 100644
--- a/web/app/yarn.lock
+++ b/web/app/yarn.lock
@@ -2176,10 +2176,10 @@ ansi-escapes@^4.2.1:
   dependencies:
     type-fest "^0.21.3"
 
-ansi-html@^0.0.7:
-  version "0.0.7"
-  resolved "https://registry.yarnpkg.com/ansi-html/-/ansi-html-0.0.7.tgz#813584021962a9e9e6fd039f940d12f56ca7859e"
-  integrity sha1-gTWEAhliqenm/QOflA0S9WynhZ4=
+ansi-html-community@^0.0.8:
+  version "0.0.8"
+  resolved "https://registry.yarnpkg.com/ansi-html-community/-/ansi-html-community-0.0.8.tgz#69fbc4d6ccbe383f9736934ae34c3f8290f1bf41"
+  integrity sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==
 
 ansi-regex@^2.0.0:
   version "2.1.1"
@@ -9547,12 +9547,12 @@ webpack-dev-middleware@^5.0.0:
     range-parser "^1.2.1"
     schema-utils "^3.0.0"
 
-webpack-dev-server@4.1.0:
-  version "4.1.0"
-  resolved "https://registry.yarnpkg.com/webpack-dev-server/-/webpack-dev-server-4.1.0.tgz#1c7a7b77bdafec334a8b81d26c586f793001b5ca"
-  integrity sha512-PnnoCHuLKxH3vYff2EbORntD0Pd+MKclDIO8AcKsDVRToqY9/oeIwwUs5alA2B5OPgXJhaDNkBJAmb0OaWZFJA==
+webpack-dev-server@4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/webpack-dev-server/-/webpack-dev-server-4.1.1.tgz#e8eb8f0ce1a0e1fa65e234641763c97735398bed"
+  integrity sha512-Kl1mnCEw8Cy1Kw173gCxLIB242LfPKEOj9WoKhKz/MbryZTNrILzOJTk8kiczw/YUEPzn3gcltCQv6hDsLudRg==
   dependencies:
-    ansi-html "^0.0.7"
+    ansi-html-community "^0.0.8"
     bonjour "^3.5.0"
     chokidar "^3.5.1"
     colorette "^1.2.2"


Test patch:
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index f20ffe6be..1c4538fb0 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index 6028de806..0963a22af 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index a4b3ca484..ebf6fbba3 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index 83923ae57..0f0b7aabe 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index b48f25117..b5ad3801e 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index bd9730655..f2f9aa8ce 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 05d7a7356..ce375228f 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index f132fcafa..244c87aee 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_helm_output.golden b/cli/cmd/testdata/install_helm_output.golden
index d814c5996..3d0605127 100644
--- a/cli/cmd/testdata/install_helm_output.golden
+++ b/cli/cmd/testdata/install_helm_output.golden
@@ -219,7 +219,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_helm_output_ha.golden b/cli/cmd/testdata/install_helm_output_ha.golden
index 27cf62eb1..e8eb4335c 100644
--- a/cli/cmd/testdata/install_helm_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_output_ha.golden
@@ -219,7 +219,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 45d53b67d..0b1fedd93 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -219,7 +219,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index 8083a7807..b76b26295 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -219,7 +219,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index b50f09687..9a8f6e648 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index 0802bee8c..01372e416 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 7cc880fe7..ed386bb14 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -213,7 +213,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 35df62f0c..9db9f38ae 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -199,7 +199,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - nodes
       - pods
     verbs:
       - get
diff --git a/policy-controller/k8s/index/src/tests.rs b/policy-controller/k8s/index/src/tests.rs
index 9a4209d95..6fdfeec85 100644
--- a/policy-controller/k8s/index/src/tests.rs
+++ b/policy-controller/k8s/index/src/tests.rs
@@ -4,7 +4,7 @@ use linkerd_policy_controller_core::{
     ClientAuthentication, ClientAuthorization, IdentityMatch, IpNet, Ipv4Net, Ipv6Net,
     NetworkMatch, ProxyProtocol,
 };
-use linkerd_policy_controller_k8s_api::policy::server::Port;
+use linkerd_policy_controller_k8s_api::{policy::server::Port, ResourceExt};
 use std::{collections::HashMap, net::IpAddr, str::FromStr};
 use tokio::time;
 
@@ -14,10 +14,6 @@ use tokio::time;
 async fn incrementally_configure_server() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
     let (lookup_rx, mut idx) = Index::new(
         vec![cluster_net],
@@ -29,13 +25,11 @@ async fn incrementally_configure_server() {
         detect_timeout,
     );
 
-    idx.apply_node(mk_node("node-0", pod_net)).unwrap();
-
     let pod = mk_pod(
         "ns-0",
         "pod-0",
         "node-0",
-        pod_ip,
+        pod_net.hosts().next().unwrap(),
         Some(("container-0", vec![2222, 9999])),
     );
     idx.apply_pod(pod.clone()).unwrap();
@@ -46,7 +40,7 @@ async fn incrementally_configure_server() {
     };
     let default_config = InboundServer {
         name: format!("default:{}", default),
-        authorizations: mk_default_policy(default, cluster_net, kubelet_ip),
+        authorizations: mk_default_policy(default, cluster_net),
         protocol: ProxyProtocol::Detect {
             timeout: detect_timeout,
         },
@@ -77,7 +71,7 @@ async fn incrementally_configure_server() {
     let basic_config = InboundServer {
         name: "srv-0".into(),
         protocol: ProxyProtocol::Http1,
-        authorizations: vec![healthcheck_authz(kubelet_ip)].into_iter().collect(),
+        authorizations: Default::default(),
     };
     assert_eq!(port2222.get(), basic_config);
     assert_eq!(port9999.get(), default_config);
@@ -104,16 +98,13 @@ async fn incrementally_configure_server() {
         Ok(Some(InboundServer {
             name: "srv-0".into(),
             protocol: ProxyProtocol::Http1,
-            authorizations: vec![
-                (
-                    "authz-0".into(),
-                    ClientAuthorization {
-                        authentication: ClientAuthentication::TlsUnauthenticated,
-                        networks: vec!["192.0.2.0/24".parse::<IpNet>().unwrap().into()]
-                    }
-                ),
-                healthcheck_authz(kubelet_ip),
-            ]
+            authorizations: vec![(
+                "authz-0".into(),
+                ClientAuthorization {
+                    authentication: ClientAuthentication::TlsUnauthenticated,
+                    networks: vec!["192.0.2.0/24".parse::<IpNet>().unwrap().into()]
+                }
+            ),]
             .into_iter()
             .collect(),
         }))
@@ -145,10 +136,6 @@ async fn incrementally_configure_server() {
 fn server_update_deselects_pod() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
     let default = DefaultPolicy::Allow {
         authenticated_only: false,
@@ -161,12 +148,11 @@ fn server_update_deselects_pod() {
         detect_timeout,
     );
 
-    idx.apply_node(mk_node("node-0", pod_net)).unwrap();
     let p = mk_pod(
         "ns-0",
         "pod-0",
         "node-0",
-        pod_ip,
+        pod_net.hosts().next().unwrap(),
         Some(("container-0", vec![2222])),
     );
     idx.apply_pod(p).unwrap();
@@ -185,7 +171,7 @@ fn server_update_deselects_pod() {
         InboundServer {
             name: "srv-0".into(),
             protocol: ProxyProtocol::Http2,
-            authorizations: vec![healthcheck_authz(kubelet_ip)].into_iter().collect(),
+            authorizations: Default::default(),
         }
     );
 
@@ -198,7 +184,7 @@ fn server_update_deselects_pod() {
         port2222.get(),
         InboundServer {
             name: format!("default:{}", default),
-            authorizations: mk_default_policy(default, cluster_net, kubelet_ip),
+            authorizations: mk_default_policy(default, cluster_net),
             protocol: ProxyProtocol::Detect {
                 timeout: detect_timeout,
             },
@@ -213,10 +199,6 @@ fn server_update_deselects_pod() {
 fn default_policy_global() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
@@ -227,20 +209,18 @@ fn default_policy_global() {
             detect_timeout,
         );
 
-        idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
         let p = mk_pod(
             "ns-0",
             "pod-0",
             "node-0",
-            pod_ip,
+            pod_net.hosts().next().unwrap(),
             Some(("container-0", vec![2222])),
         );
         idx.reset_pods(vec![p]).unwrap();
 
         let config = InboundServer {
             name: format!("default:{}", default),
-            authorizations: mk_default_policy(*default, cluster_net, kubelet_ip),
+            authorizations: mk_default_policy(*default, cluster_net),
             protocol: ProxyProtocol::Detect {
                 timeout: detect_timeout,
             },
@@ -262,10 +242,6 @@ fn default_policy_global() {
 fn default_policy_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
@@ -283,13 +259,11 @@ fn default_policy_annotated() {
             detect_timeout,
         );
 
-        idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
         let mut p = mk_pod(
             "ns-0",
             "pod-0",
             "node-0",
-            pod_ip,
+            pod_net.hosts().next().unwrap(),
             Some(("container-0", vec![2222])),
         );
         p.annotations_mut()
@@ -298,7 +272,7 @@ fn default_policy_annotated() {
 
         let config = InboundServer {
             name: format!("default:{}", default),
-            authorizations: mk_default_policy(*default, cluster_net, kubelet_ip),
+            authorizations: mk_default_policy(*default, cluster_net),
             protocol: ProxyProtocol::Detect {
                 timeout: detect_timeout,
             },
@@ -315,10 +289,6 @@ fn default_policy_annotated() {
 fn default_policy_annotated_invalid() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
 
     let default = DefaultPolicy::Allow {
@@ -332,13 +302,11 @@ fn default_policy_annotated_invalid() {
         detect_timeout,
     );
 
-    idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
     let mut p = mk_pod(
         "ns-0",
         "pod-0",
         "node-0",
-        pod_ip,
+        pod_net.hosts().next().unwrap(),
         Some(("container-0", vec![2222])),
     );
     p.annotations_mut()
@@ -359,7 +327,6 @@ fn default_policy_annotated_invalid() {
                     cluster_only: false,
                 },
                 cluster_net,
-                kubelet_ip
             ),
             protocol: ProxyProtocol::Detect {
                 timeout: detect_timeout,
@@ -372,10 +339,6 @@ fn default_policy_annotated_invalid() {
 fn opaque_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
@@ -386,13 +349,11 @@ fn opaque_annotated() {
             detect_timeout,
         );
 
-        idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
         let mut p = mk_pod(
             "ns-0",
             "pod-0",
             "node-0",
-            pod_ip,
+            pod_net.hosts().next().unwrap(),
             Some(("container-0", vec![2222])),
         );
         p.annotations_mut()
@@ -401,7 +362,7 @@ fn opaque_annotated() {
 
         let config = InboundServer {
             name: format!("default:{}", default),
-            authorizations: mk_default_policy(*default, cluster_net, kubelet_ip),
+            authorizations: mk_default_policy(*default, cluster_net),
             protocol: ProxyProtocol::Opaque,
         };
 
@@ -416,10 +377,6 @@ fn opaque_annotated() {
 fn authenticated_annotated() {
     let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
     let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
     let detect_timeout = time::Duration::from_secs(1);
 
     for default in &DEFAULTS {
@@ -430,13 +387,11 @@ fn authenticated_annotated() {
             detect_timeout,
         );
 
-        idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
         let mut p = mk_pod(
             "ns-0",
             "pod-0",
             "node-0",
-            pod_ip,
+            pod_net.hosts().next().unwrap(),
             Some(("container-0", vec![2222])),
         );
         p.annotations_mut().insert(
@@ -455,7 +410,7 @@ fn authenticated_annotated() {
             };
             InboundServer {
                 name: format!("default:{}", policy),
-                authorizations: mk_default_policy(policy, cluster_net, kubelet_ip),
+                authorizations: mk_default_policy(policy, cluster_net),
                 protocol: ProxyProtocol::Detect {
                     timeout: detect_timeout,
                 },
@@ -470,99 +425,6 @@ fn authenticated_annotated() {
     }
 }
 
-/// Tests observing a pod before its node has been observed amid resets.
-#[test]
-fn pod_before_node_reset() {
-    let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
-    let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (_kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
-    let detect_timeout = time::Duration::from_secs(1);
-
-    let (lookup_rx, mut idx) = Index::new(
-        vec![cluster_net],
-        "cluster.example.com".into(),
-        DefaultPolicy::Deny,
-        detect_timeout,
-    );
-
-    // First we create a pod for which the node has not yet been observed so that it's marked as
-    // pending.
-    let p = mk_pod(
-        "ns-0",
-        "pod-0",
-        "node-0",
-        pod_ip,
-        Some(("container-0", vec![2222])),
-    );
-    idx.reset_pods(vec![p]).unwrap();
-    assert!(lookup_rx.lookup("ns-0", "pod-0", 2222).is_none());
-
-    // Then we reset with a new pod which will be pending on the same node.
-    let p = mk_pod(
-        "ns-0",
-        "pod-1",
-        "node-0",
-        pod_ip,
-        Some(("container-0", vec![3333])),
-    );
-    idx.reset_pods(vec![p]).unwrap();
-
-    // Then we reset the nodes so that the node is added.
-    idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
-    // Once the node is created, the first pod should not be discoverable but the second pod should be.
-    assert!(
-        lookup_rx.lookup("ns-0", "pod-0", 2222).is_none(),
-        "first pod must not exist"
-    );
-    lookup_rx
-        .lookup("ns-0", "pod-1", 3333)
-        .expect("second pod must exist");
-}
-
-/// Tests observing a pod before its node has been observed amid resets.
-#[test]
-fn pod_before_node_remove() {
-    let cluster_net = IpNet::from_str("192.0.2.0/24").unwrap();
-    let pod_net = IpNet::from_str("192.0.2.2/28").unwrap();
-    let (_kubelet_ip, pod_ip) = {
-        let mut ips = pod_net.hosts();
-        (ips.next().unwrap(), ips.next().unwrap())
-    };
-    let detect_timeout = time::Duration::from_secs(1);
-
-    let (lookup_rx, mut idx) = Index::new(
-        vec![cluster_net],
-        "cluster.example.com".into(),
-        DefaultPolicy::Deny,
-        detect_timeout,
-    );
-
-    // First we create a pod for which the node has not yet been observed so that it's marked as
-    // pending.
-    let pod = mk_pod(
-        "ns-0",
-        "pod-0",
-        "node-0",
-        pod_ip,
-        Some(("container-0", vec![2222])),
-    );
-    idx.reset_pods(vec![pod.clone()]).unwrap();
-    assert!(lookup_rx.lookup("ns-0", "pod-0", 2222).is_none());
-
-    // Then we delete that pod without updating the nodes.
-    idx.delete_pod(pod).unwrap();
-
-    // Then we reset the nodes so that the node is added.
-    idx.reset_nodes(vec![mk_node("node-0", pod_net)]).unwrap();
-
-    // Once the node is created, the pod must not be discoverable.
-    assert!(lookup_rx.lookup("ns-0", "pod-0", 2222).is_none());
-}
-
 // === Helpers ===
 
 const DEFAULTS: [DefaultPolicy; 5] = [
@@ -585,21 +447,6 @@ const DEFAULTS: [DefaultPolicy; 5] = [
     },
 ];
 
-fn mk_node(name: impl Into<String>, pod_net: IpNet) -> k8s::Node {
-    k8s::Node {
-        metadata: k8s::ObjectMeta {
-            name: Some(name.into()),
-            ..Default::default()
-        },
-        spec: Some(k8s::api::core::v1::NodeSpec {
-            pod_cidr: Some(pod_net.to_string()),
-            pod_cidrs: Some(vec![pod_net.to_string()]),
-            ..Default::default()
-        }),
-        status: Some(k8s::api::core::v1::NodeStatus::default()),
-    }
-}
-
 fn mk_pod(
     ns: impl Into<String>,
     name: impl Into<String>,
@@ -698,7 +545,6 @@ fn mk_authz(
 fn mk_default_policy(
     da: DefaultPolicy,
     cluster_net: IpNet,
-    kubelet_ip: IpAddr,
 ) -> HashMap<String, ClientAuthorization> {
     let all_nets = vec![Ipv4Net::default().into(), Ipv6Net::default().into()];
 
@@ -750,16 +596,5 @@ fn mk_default_policy(
         )),
     }
     .into_iter()
-    .chain(Some(healthcheck_authz(kubelet_ip)))
     .collect()
 }
-
-fn healthcheck_authz(ip: IpAddr) -> (String, ClientAuthorization) {
-    (
-        "default:kubelet".into(),
-        ClientAuthorization {
-            networks: vec![NetworkMatch::from(IpNet::from(ip))],
-            authentication: ClientAuthentication::Unauthenticated,
-        },
-    )
-}