Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-02-19 19:47:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/grafana-loki] feat: 🔒 Enable networkPolicy and fix containerSecurityContext (#23261)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
Signed-off-by: Javier J. Salmerón-García <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-02-12 10:49:50 +01:00
committed by GitHub
parent e8c2230b05
commit 292c9bdcc1
14 changed files with 3310 additions and 955 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/grafana-loki/Chart.yaml
View File

@@ -57,4 +57,4 @@ maintainers:
name: grafana-loki
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/grafana-loki
version: 2.14.7
version: 2.15.0

1964
bitnami/grafana-loki/README.md
View File

File diff suppressed because it is too large Load Diff

146
bitnami/grafana-loki/templates/compactor/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,146 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.compactor.enabled .Values.compactor.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.compactor.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: compactor
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.compactor.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: compactor
policyTypes:
- Ingress
- Egress
{{- if .Values.compactor.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.compactor.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.compactor.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.compactor.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.compactor.fullname" . }}-compactor: "true"
{{- if .Values.compactor.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.compactor.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.compactor.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.compactor.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.compactor.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.compactor.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/distributor/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.distributor.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.distributor.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: distributor
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.distributor.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: distributor
policyTypes:
- Ingress
- Egress
{{- if .Values.distributor.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.distributor.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.distributor.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.distributor.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.distributor.fullname" . }}-distributor: "true"
{{- if .Values.distributor.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.distributor.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.distributor.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.distributor.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.distributor.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.distributor.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

137
bitnami/grafana-loki/templates/gateway/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,137 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.gateway.enabled .Values.gateway.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.gateway.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.gateway.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
policyTypes:
- Ingress
- Egress
{{- if .Values.gateway.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.gateway.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.gateway.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
{{- if not .Values.gateway.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.gateway.fullname" . }}-gateway: "true"
{{- if .Values.gateway.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.gateway.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.gateway.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.gateway.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.gateway.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.gateway.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/index-gateway/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.indexGateway.enabled .Values.indexGateway.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.index-gateway.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: index-gateway
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.indexGateway.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: index-gateway
policyTypes:
- Ingress
- Egress
{{- if .Values.indexGateway.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.indexGateway.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.indexGateway.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.indexGateway.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.index-gateway.fullname" . }}-index-gateway: "true"
{{- if .Values.indexGateway.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.indexGateway.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.indexGateway.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.indexGateway.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.indexGateway.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.indexGateway.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/ingester/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingester.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.ingester.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: ingester
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingester.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: ingester
policyTypes:
- Ingress
- Egress
{{- if .Values.ingester.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.ingester.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.ingester.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.ingester.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.ingester.fullname" . }}-ingester: "true"
{{- if .Values.ingester.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.ingester.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.ingester.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.ingester.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.ingester.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.ingester.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

139
bitnami/grafana-loki/templates/promtail/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,139 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.promtail.enabled .Values.promtail.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.promtail.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: promtail
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.promtail.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: promtail
policyTypes:
- Ingress
- Egress
{{- if .Values.promtail.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
{{- range $port := .Values.promtail.networkPolicy.kubeAPIServerPorts }}
- port: {{ $port }}
{{- end }}
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.promtail.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.promtail.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.promtail.containerPorts.http }}
{{- if not .Values.promtail.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.promtail.fullname" . }}-promtail: "true"
{{- if .Values.promtail.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.promtail.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.promtail.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.promtail.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.promtail.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.promtail.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/querier/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.querier.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.querier.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: querier
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.querier.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: querier
policyTypes:
- Ingress
- Egress
{{- if .Values.querier.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.querier.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.querier.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.querier.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.querier.fullname" . }}-querier: "true"
{{- if .Values.querier.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.querier.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.querier.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.querier.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.querier.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.querier.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/query-frontend/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.queryFrontend.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.query-frontend.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: query-frontend
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.queryFrontend.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: query-frontend
policyTypes:
- Ingress
- Egress
{{- if .Values.queryFrontend.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.queryFrontend.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.queryFrontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.queryFrontend.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.query-frontend.fullname" . }}-query-frontend: "true"
{{- if .Values.queryFrontend.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.queryFrontend.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.queryFrontend.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.queryFrontend.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.queryFrontend.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.queryFrontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/query-scheduler/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.queryScheduler.enabled .Values.queryScheduler.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.query-scheduler.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: query-scheduler
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.queryScheduler.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: query-scheduler
policyTypes:
- Ingress
- Egress
{{- if .Values.queryScheduler.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.queryScheduler.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.queryScheduler.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.queryScheduler.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.query-scheduler.fullname" . }}-query-scheduler: "true"
{{- if .Values.queryScheduler.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.queryScheduler.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.queryScheduler.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.queryScheduler.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.queryScheduler.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.queryScheduler.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/ruler/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ruler.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.ruler.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: ruler
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.ruler.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: ruler
policyTypes:
- Ingress
- Egress
{{- if .Values.ruler.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.ruler.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.ruler.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.ruler.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.ruler.fullname" . }}-ruler: "true"
{{- if .Values.ruler.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.ruler.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.ruler.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.ruler.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.ruler.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.ruler.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

138
bitnami/grafana-loki/templates/table-manager/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,138 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.tableManager.enabled .Values.tableManager.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "grafana-loki.table-manager.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: table-manager
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.tableManager.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: table-manager
policyTypes:
- Ingress
- Egress
{{- if .Values.tableManager.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to loki cluster
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
# Allow outbound connections to gateway
- ports:
- port: {{ .Values.gateway.containerPorts.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
app.kubernetes.io/component: gateway
# Allow outbound connections to Memcached Chunks
- ports:
{{- if .Values.memcachedchunks.enabled }}
- port: {{ .Values.memcachedchunks.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedchunks
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedChunks.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexqueries.enabled }}
- port: {{ .Values.memcachedindexqueries.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexqueries
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexQueries.port }}
{{- end }}
# Allow outbound connections to Memcached Frontend
- ports:
{{- if .Values.memcachedfrontend.enabled }}
- port: {{ .Values.memcachedfrontend.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedfrontend
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedFrontend.port }}
{{- end }}
# Allow outbound connections to Memcached Metadata
- ports:
{{- if .Values.memcachedindexwrites.enabled }}
- port: {{ .Values.memcachedindexwrites.containerPorts.memcached }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: memcachedindexwrites
app.kubernetes.io/instance: {{ .Release.Name }}
{{- else }}
- port: {{ .Values.externalMemcachedIndexWrites.port }}
{{- end }}
{{- if .Values.tableManager.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.tableManager.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.loki.containerPorts.http }}
- port: {{ .Values.loki.containerPorts.gossipRing }}
- port: {{ .Values.loki.containerPorts.grpc }}
{{- if not .Values.tableManager.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/part-of: grafana-loki
- podSelector:
matchLabels:
{{ template "grafana-loki.table-manager.fullname" . }}-table-manager: "true"
{{- if .Values.tableManager.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.tableManager.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.tableManager.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.tableManager.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.tableManager.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.tableManager.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

773
bitnami/grafana-loki/values.yaml
View File

@@ -377,10 +377,14 @@ compactor:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param compactor.containerSecurityContext.enabled Enabled Compactor containers' Security Context
## @param compactor.containerSecurityContext.enabled Enable containers' Security Context
## @param compactor.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param compactor.containerSecurityContext.runAsUser Set Compactor containers' Security Context runAsUser
## @param compactor.containerSecurityContext.runAsNonRoot Set Compactor containers' Security Context runAsNonRoot
## @param compactor.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param compactor.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param compactor.containerSecurityContext.privileged Set container's Security Context privileged
## @param compactor.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param compactor.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param compactor.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param compactor.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -388,6 +392,11 @@ compactor:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param compactor.lifecycleHooks for the compactor container(s) to automate configuration before or after startup
@@ -588,6 +597,61 @@ compactor:
## @param compactor.service.extraPorts Extra ports to expose in the Compactor service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param compactor.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param compactor.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param compactor.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param compactor.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param compactor.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param compactor.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param compactor.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Gateway Deployment Parameters
##
@@ -745,10 +809,14 @@ gateway:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param gateway.containerSecurityContext.enabled Enabled Gateway containers' Security Context
## @param gateway.containerSecurityContext.enabled Enabled containers' Security Context
## @param gateway.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param gateway.containerSecurityContext.runAsUser Set Gateway containers' Security Context runAsUser
## @param gateway.containerSecurityContext.runAsNonRoot Set Gateway containers' Security Context runAsNonRoot
## @param gateway.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param gateway.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param gateway.containerSecurityContext.privileged Set container's Security Context privileged
## @param gateway.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param gateway.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param gateway.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param gateway.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -756,6 +824,11 @@ gateway:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param gateway.lifecycleHooks for the gateway container(s) to automate configuration before or after startup
@@ -916,6 +989,61 @@ gateway:
## @param gateway.service.extraPorts Extra ports to expose in the Gateway service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param gateway.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param gateway.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param gateway.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param gateway.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param gateway.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param gateway.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param gateway.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## Configure the ingress resource that allows you to access the Loki Gateway installation
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
@@ -1123,10 +1251,14 @@ indexGateway:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param indexGateway.containerSecurityContext.enabled Enabled index-gateway containers' Security Context
## @param indexGateway.containerSecurityContext.enabled Enabled containers' Security Context
## @param indexGateway.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param indexGateway.containerSecurityContext.runAsUser Set index-gateway containers' Security Context runAsUser
## @param indexGateway.containerSecurityContext.runAsNonRoot Set index-gateway containers' Security Context runAsNonRoot
## @param indexGateway.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param indexGateway.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param indexGateway.containerSecurityContext.privileged Set container's Security Context privileged
## @param indexGateway.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param indexGateway.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param indexGateway.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param indexGateway.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -1134,6 +1266,11 @@ indexGateway:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param indexGateway.lifecycleHooks for the indexGateway container(s) to automate configuration before or after startup
@@ -1298,6 +1435,61 @@ indexGateway:
## @param indexGateway.service.extraPorts Extra ports to expose in the index-gateway service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param indexGateway.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param indexGateway.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param indexGateway.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param indexGateway.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param indexGateway.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param indexGateway.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param indexGateway.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Distributor Deployment Parameters
##
@@ -1404,10 +1596,14 @@ distributor:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param distributor.containerSecurityContext.enabled Enabled Distributor containers' Security Context
## @param distributor.containerSecurityContext.enabled Enabled containers' Security Context
## @param distributor.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param distributor.containerSecurityContext.runAsUser Set Distributor containers' Security Context runAsUser
## @param distributor.containerSecurityContext.runAsNonRoot Set Distributor containers' Security Context runAsNonRoot
## @param distributor.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param distributor.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param distributor.containerSecurityContext.privileged Set container's Security Context privileged
## @param distributor.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param distributor.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param distributor.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param distributor.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -1415,6 +1611,11 @@ distributor:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param distributor.lifecycleHooks for the distributor container(s) to automate configuration before or after startup
@@ -1579,6 +1780,61 @@ distributor:
## @param distributor.service.extraPorts Extra ports to expose in the Distributor service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param distributor.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param distributor.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param distributor.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param distributor.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param distributor.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param distributor.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param distributor.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Ingester Deployment Parameters
##
@@ -1688,10 +1944,14 @@ ingester:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param ingester.containerSecurityContext.enabled Enabled Ingester containers' Security Context
## @param ingester.containerSecurityContext.enabled Enabled containers' Security Context
## @param ingester.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param ingester.containerSecurityContext.runAsUser Set Ingester containers' Security Context runAsUser
## @param ingester.containerSecurityContext.runAsNonRoot Set Ingester containers' Security Context runAsNonRoot
## @param ingester.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param ingester.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param ingester.containerSecurityContext.privileged Set container's Security Context privileged
## @param ingester.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param ingester.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param ingester.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param ingester.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -1699,6 +1959,11 @@ ingester:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param ingester.automountServiceAccountToken Mount Service Account token in pod
@@ -1904,6 +2169,61 @@ ingester:
## @param ingester.service.extraPorts Extra ports to expose in the Ingester service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param ingester.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param ingester.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param ingester.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param ingester.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param ingester.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param ingester.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param ingester.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Querier Deployment Parameters
##
@@ -2014,10 +2334,14 @@ querier:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param querier.containerSecurityContext.enabled Enabled Querier containers' Security Context
## @param querier.containerSecurityContext.enabled Enabled containers' Security Context
## @param querier.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param querier.containerSecurityContext.runAsUser Set Querier containers' Security Context runAsUser
## @param querier.containerSecurityContext.runAsNonRoot Set Querier containers' Security Context runAsNonRoot
## @param querier.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param querier.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param querier.containerSecurityContext.privileged Set container's Security Context privileged
## @param querier.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param querier.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param querier.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param querier.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -2025,6 +2349,11 @@ querier:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param querier.lifecycleHooks for the Querier container(s) to automate configuration before or after startup
@@ -2229,6 +2558,61 @@ querier:
## @param querier.service.extraPorts Extra ports to expose in the Querier service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param querier.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param querier.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param querier.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param querier.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param querier.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param querier.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param querier.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Query Frontend Deployment Parameters
##
@@ -2335,10 +2719,14 @@ queryFrontend:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param queryFrontend.containerSecurityContext.enabled Enabled queryFrontend containers' Security Context
## @param queryFrontend.containerSecurityContext.enabled Enabled containers' Security Context
## @param queryFrontend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param queryFrontend.containerSecurityContext.runAsUser Set queryFrontend containers' Security Context runAsUser
## @param queryFrontend.containerSecurityContext.runAsNonRoot Set queryFrontend containers' Security Context runAsNonRoot
## @param queryFrontend.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param queryFrontend.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param queryFrontend.containerSecurityContext.privileged Set container's Security Context privileged
## @param queryFrontend.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param queryFrontend.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param queryFrontend.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param queryFrontend.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -2346,6 +2734,11 @@ queryFrontend:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param queryFrontend.lifecycleHooks for the queryFrontend container(s) to automate configuration before or after startup
@@ -2516,6 +2909,61 @@ queryFrontend:
## @param queryFrontend.service.headless.annotations Annotations for the headless service.
##
annotations: {}
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param queryFrontend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param queryFrontend.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param queryFrontend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param queryFrontend.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param queryFrontend.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param queryFrontend.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param queryFrontend.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Query Scheduler Deployment Parameters
##
queryScheduler:
@@ -2626,10 +3074,14 @@ queryScheduler:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param queryScheduler.containerSecurityContext.enabled Enabled queryScheduler containers' Security Context
## @param queryScheduler.containerSecurityContext.enabled Enabled containers' Security Context
## @param queryScheduler.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param queryScheduler.containerSecurityContext.runAsUser Set queryScheduler containers' Security Context runAsUser
## @param queryScheduler.containerSecurityContext.runAsNonRoot Set queryScheduler containers' Security Context runAsNonRoot
## @param queryScheduler.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param queryScheduler.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param queryScheduler.containerSecurityContext.privileged Set container's Security Context privileged
## @param queryScheduler.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param queryScheduler.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param queryScheduler.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param queryScheduler.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -2637,6 +3089,11 @@ queryScheduler:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param queryScheduler.lifecycleHooks for the queryScheduler container(s) to automate configuration before or after startup
@@ -2801,6 +3258,61 @@ queryScheduler:
## @param queryScheduler.service.extraPorts Extra ports to expose in the queryScheduler service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param queryScheduler.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param queryScheduler.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param queryScheduler.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param queryScheduler.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param queryScheduler.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param queryScheduler.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param queryScheduler.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Ruler Deployment Parameters
##
@@ -2917,10 +3429,14 @@ ruler:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param ruler.containerSecurityContext.enabled Enabled Ruler containers' Security Context
## @param ruler.containerSecurityContext.enabled Enabled containers' Security Context
## @param ruler.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param ruler.containerSecurityContext.runAsUser Set Ruler containers' Security Context runAsUser
## @param ruler.containerSecurityContext.runAsNonRoot Set Ruler containers' Security Context runAsNonRoot
## @param ruler.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param ruler.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param ruler.containerSecurityContext.privileged Set container's Security Context privileged
## @param ruler.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param ruler.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param ruler.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param ruler.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -2928,6 +3444,11 @@ ruler:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param ruler.automountServiceAccountToken Mount Service Account token in pod
@@ -3129,6 +3650,61 @@ ruler:
## @param ruler.service.extraPorts Extra ports to expose in the Ruler service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param ruler.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param ruler.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param ruler.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param ruler.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param ruler.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param ruler.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param ruler.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section table-manager Deployment Parameters
##
@@ -3238,10 +3814,14 @@ tableManager:
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param tableManager.containerSecurityContext.enabled Enabled table-manager containers' Security Context
## @param tableManager.containerSecurityContext.enabled Enabled containers' Security Context
## @param tableManager.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param tableManager.containerSecurityContext.runAsUser Set table-manager containers' Security Context runAsUser
## @param tableManager.containerSecurityContext.runAsNonRoot Set table-manager containers' Security Context runAsNonRoot
## @param tableManager.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param tableManager.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param tableManager.containerSecurityContext.privileged Set container's Security Context privileged
## @param tableManager.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param tableManager.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param tableManager.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param tableManager.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -3249,6 +3829,11 @@ tableManager:
seLinuxOptions: null
runAsUser: 1001
runAsNonRoot: true
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param tableManager.lifecycleHooks for the tableManager container(s) to automate configuration before or after startup
@@ -3413,6 +3998,61 @@ tableManager:
## @param tableManager.service.extraPorts Extra ports to expose in the table-manager service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param tableManager.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param tableManager.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param tableManager.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param tableManager.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param tableManager.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param tableManager.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param tableManager.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Promtail Deployment Parameters
##
@@ -3556,10 +4196,14 @@ promtail:
fsGroup: 0
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param promtail.containerSecurityContext.enabled Enabled Promtail containers' Security Context
## @param promtail.containerSecurityContext.enabled Enabled containers' Security Context
## @param promtail.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
## @param promtail.containerSecurityContext.runAsUser Set Promtail containers' Security Context runAsUser
## @param promtail.containerSecurityContext.runAsNonRoot Set Promtail containers' Security Context runAsNonRoot
## @param promtail.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
## @param promtail.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
## @param promtail.containerSecurityContext.privileged Set container's Security Context privileged
## @param promtail.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
## @param promtail.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
## @param promtail.containerSecurityContext.capabilities.drop List of capabilities to be dropped
## @param promtail.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
##
containerSecurityContext:
@@ -3567,6 +4211,11 @@ promtail:
seLinuxOptions: null
runAsUser: 0
runAsNonRoot: false
privileged: false
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## @param promtail.automountServiceAccountToken Mount Service Account token in pod
@@ -3816,6 +4465,64 @@ promtail:
## @param promtail.service.extraPorts Extra ports to expose in the Promtail service
##
extraPorts: []
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param promtail.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param promtail.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param promtail.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
##
allowExternalEgress: true
## @param promtail.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
##
kubeAPIServerPorts: [443, 6443, 8443]
## @param promtail.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param promtail.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param promtail.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param promtail.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## Create RBAC
## @param promtail.rbac.create Create RBAC rules