High availability and network controls for the Universal Forwarder

Configure a PodDisruptionBudget and NetworkPolicy to control Universal Forwarder pod availability and network traffic.

Use these controls to protect Universal Forwarder availability during cluster maintenance and to restrict its network traffic.

PodDisruptionBudget

Prevents the Kubernetes scheduler from evicting too many UF pods at once during node maintenance or cluster upgrades.

CODE 
--set podDisruptionBudget.enabled=true \
--set podDisruptionBudget.minAvailable=1

NetworkPolicy

Lock down which pods can reach the UF and where the UF can send traffic.

CODE 
# values-override.yaml
networkPolicy:
  enabled: true
  ingress:
    - ports:
        - protocol: UDP
          port: 514
        - protocol: TCP
          port: 8088
  egress:
    - ports:
        - protocol: TCP
          port: 9997   # allow forwarding to indexers
Note: When networkPolicy.enabled=true with empty ingress and egress lists, the policy blocks all inbound and outbound traffic.