Skip to content

Commit b863bbd

Browse files
cluxclux
authored
Network policy template (#62)
* Network policy template Signed-off-by: clux <sszynrae@gmail.com> * fixup so that it can be installed by default Signed-off-by: clux <sszynrae@gmail.com> * not sure this will work, but give it a go Signed-off-by: clux <sszynrae@gmail.com> * go full crazy on this Signed-off-by: clux <sszynrae@gmail.com> * debug :( Signed-off-by: clux <sszynrae@gmail.com> * port by ref? Signed-off-by: clux <sszynrae@gmail.com> * another test Signed-off-by: clux <sszynrae@gmail.com> * double check weirdness Signed-off-by: clux <sszynrae@gmail.com> * finalizers rbac? Signed-off-by: clux <sszynrae@gmail.com> * right, update is a verb Signed-off-by: clux <sszynrae@gmail.com> * yeah, include the service account :| Signed-off-by: clux <sszynrae@gmail.com> * no one should need to deal with this Signed-off-by: clux <sszynrae@gmail.com> * final hide kubernetesPort (just do the two normal ones) Signed-off-by: clux <sszynrae@gmail.com> * more defensiveness Signed-off-by: clux <sszynrae@gmail.com> * include protocol Signed-off-by: clux <sszynrae@gmail.com> * ..leave default wide open so we can at least leave netpol on people who know how to do this can scope it Signed-off-by: clux <sszynrae@gmail.com> * undo defensive verbs Signed-off-by: clux <sszynrae@gmail.com> * gen Signed-off-by: clux <sszynrae@gmail.com> --------- Signed-off-by: clux <sszynrae@gmail.com>
1 parent bb70569 commit b863bbd

File tree

7 files changed

+160
-11
lines changed

7 files changed

+160
-11
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ jobs:
145145
- uses: actions/checkout@v3
146146
- uses: nolar/setup-k3d-k3s@v1
147147
with:
148-
version: v1.26
148+
version: v1.27
149149
k3d-name: kube
150150
k3d-args: "--no-lb --no-rollback --k3s-arg --disable=traefik,servicelb,metrics-server@server:*"
151151
- run: kubectl apply -f yaml/crd.yaml
@@ -158,11 +158,20 @@ jobs:
158158
path: /tmp
159159
- name: Load docker image from tarball
160160
run: docker load --input /tmp/image.tar
161-
- run: helm template charts/doc-controller --set version="latest" | kubectl apply -f -
161+
- name: helm template | kubctl apply
162+
run: |
163+
apiserver="$(kubectl get endpoints kubernetes -ojson | jq '.subsets[0].addresses[0].ip' -r)"
164+
helm template charts/doc-controller \
165+
--set version=latest \
166+
--set networkPolicy.enabled=true \
167+
--set networkPolicy.apiserver.0=${apiserver}/32 \
168+
| kubectl apply -f -
162169
- run: kubectl wait --for=condition=available deploy/doc-controller --timeout=30s
163170
- run: kubectl apply -f yaml/instance-samuel.yaml
164171
- run: sleep 2 # TODO: add condition on status and wait for it instead
165172
# verify reconcile actions have happened
173+
- run: kubectl get netpol doc-controller -oyaml
174+
- run: kubectl logs deploy/doc-controller
166175
- run: kubectl get event --field-selector "involvedObject.kind=Document,involvedObject.name=samuel" | grep "HideRequested"
167176
- run: kubectl get doc -oyaml | grep -A1 finalizers | grep documents.kube.rs
168177

‎charts/doc-controller/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ spec:
4545
value: {{ .Values.logging.env_filter }}
4646
{{- if .Values.tracing.enabled }}
4747
- name: OPENTELEMETRY_ENDPOINT_URL
48-
value: {{ .Values.tracing.endpoint }}
48+
value: https://{{ .Values.tracing.service }}.{{ .Values.tracing.namespace }}.cluster.local:{{ .Values.tracing.port }}
4949
{{- end }}
5050
{{- with .Values.env }}
5151
{{- toYaml . | nindent 8 }}

‎charts/doc-controller/templates/networkpolicy.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
---
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: {{ include "controller.fullname" . }}
7+
namespace: {{ .Values.namespace }}
8+
labels:
9+
{{- include "controller.labels" . | nindent 4 }}
10+
spec:
11+
podSelector:
12+
matchLabels:
13+
{{- include "controller.selectorLabels" . | nindent 6 }}
14+
policyTypes:
15+
- Ingress
16+
- Egress
17+
egress:
18+
{{- if .Values.tracing.enabled }}
19+
# pushing tracing spans to a collector
20+
- to:
21+
- namespaceSelector:
22+
matchLabels:
23+
name: {{.Values.tracing.namespace }}
24+
ports:
25+
- port: {{ .Values.tracing.port }}
26+
protocol: TCP
27+
{{- end }}
28+
29+
# Kubernetes apiserver access
30+
- to:
31+
- ipBlock:
32+
{{- range .Values.networkPolicy.apiserver }}
33+
cidr: {{ . }}
34+
{{- end }}
35+
ports:
36+
- port: 443
37+
protocol: TCP
38+
- port: 6443
39+
protocol: TCP
40+
41+
{{- if .Values.networkPolicy.dns }}
42+
# DNS egress
43+
- to:
44+
- podSelector:
45+
matchLabels:
46+
k8s-app: kube-dns
47+
ports:
48+
- port: 53
49+
protocol: UDP
50+
{{- end }}
51+
52+
ingress:
53+
{{- with .Values.networkPolicy.prometheus }}
54+
{{- if .enabled }}
55+
# prometheus metrics scraping support
56+
- from:
57+
- namespaceSelector:
58+
matchLabels:
59+
name: {{ .namespace }}
60+
podSelector:
61+
matchLabels:
62+
app: {{ .app }}
63+
ports:
64+
- port: {{ .port }}
65+
protocol: TCP
66+
{{- end }}
67+
{{- end }}
68+
69+
{{- end }}

‎charts/doc-controller/templates/rbac.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if .Values.serviceAccount.create }}
12
---
23
# Scoped service account
34
apiVersion: v1
@@ -12,6 +13,7 @@ metadata:
1213
{{- end }}
1314
namespace: {{ .Values.namespace }}
1415
automountServiceAccountToken: true
16+
{{- end }}
1517

1618
---
1719
# Access for the service account
@@ -21,8 +23,8 @@ metadata:
2123
name: {{ include "controller.fullname" . }}
2224
rules:
2325
- apiGroups: ["kube.rs"]
24-
resources: ["documents", "documents/status"]
25-
verbs: ["get", "list", "watch", "patch"]
26+
resources: ["documents", "documents/status", "documents/finalizers"]
27+
verbs: ["get", "list", "watch", "patch", "update"]
2628
- apiGroups: ["events.k8s.io"]
2729
resources: ["events"]
2830
verbs: ["create"]

‎charts/doc-controller/templates/servicemonitor.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ spec:
3434
jobLabel: {{ include "controller.fullname" . }}
3535
selector:
3636
matchLabels:
37-
app: {{ include "controller.fullname" . }}
37+
{{- include "controller.selectorLabels" . | nindent 6 }}
3838
namespaceSelector:
3939
matchNames:
4040
- {{ .Values.namespace }}

‎charts/doc-controller/values.yaml‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ image:
1010
imagePullSecrets: []
1111

1212
serviceAccount:
13+
create: true
1314
annotations: {}
1415
podAnnotations: {}
1516

@@ -23,10 +24,28 @@ securityContext: {}
2324
# runAsNonRoot: true
2425
# runAsUser: 1000
2526

26-
# Enable the feature-flagged opentelemetry trace layer pushing over grpc
27+
# Configure the gRPC opentelemetry push url
2728
tracing:
28-
enabled: false # prefixes tag with otel
29-
endpoint: "https://promstack-tempo.monitoring.svc.cluster.local:4317"
29+
# Use the telemetry built image and inject OPENTELEMETRY_ENDPOINT_URL
30+
enabled: false
31+
# namespace of the collector
32+
namespace: monitoring
33+
# collector service name
34+
service: promstack-tempo
35+
# collector port for OTLP gRPC
36+
port: 4317
37+
38+
networkPolicy:
39+
enabled: true
40+
dns: true
41+
# apiserver access: please scope; take addresses from "kubectl get endpoints kubernetes -n default"
42+
apiserver:
43+
- "0.0.0.0/0" # extremely wide-open egress on ports 443 + 6443
44+
prometheus:
45+
enabled: true
46+
namespace: monitoring
47+
app: prometheus
48+
port: http
3049

3150
logging:
3251
env_filter: info,kube=debug,controller=debug

‎yaml/deployment.yaml‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,54 @@
11
---
2+
# Source: doc-controller/templates/networkpolicy.yaml
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: doc-controller
7+
namespace: default
8+
labels:
9+
app: doc-controller
10+
app.kubernetes.io/name: doc-controller
11+
app.kubernetes.io/version: "0.12.10"
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
app: doc-controller
16+
policyTypes:
17+
- Ingress
18+
- Egress
19+
egress:
20+
21+
# Kubernetes apiserver access
22+
- to:
23+
- ipBlock:
24+
cidr: 0.0.0.0/0
25+
ports:
26+
- port: 443
27+
protocol: TCP
28+
- port: 6443
29+
protocol: TCP
30+
# DNS egress
31+
- to:
32+
- podSelector:
33+
matchLabels:
34+
k8s-app: kube-dns
35+
ports:
36+
- port: 53
37+
protocol: UDP
38+
39+
ingress:
40+
# prometheus metrics scraping support
41+
- from:
42+
- namespaceSelector:
43+
matchLabels:
44+
name: monitoring
45+
podSelector:
46+
matchLabels:
47+
app: prometheus
48+
ports:
49+
- port: http
50+
protocol: TCP
51+
---
252
# Source: doc-controller/templates/rbac.yaml
353
# Scoped service account
454
apiVersion: v1
@@ -20,8 +70,8 @@ metadata:
2070
name: doc-controller
2171
rules:
2272
- apiGroups: ["kube.rs"]
23-
resources: ["documents", "documents/status"]
24-
verbs: ["get", "list", "watch", "patch"]
73+
resources: ["documents", "documents/status", "documents/finalizers"]
74+
verbs: ["get", "list", "watch", "patch", "update"]
2575
- apiGroups: ["events.k8s.io"]
2676
resources: ["events"]
2777
verbs: ["create"]

0 commit comments

Comments
 (0)