mirror of
https://github.com/bitnami/charts.git
synced 2026-03-05 06:47:25 +08:00
[bitnami/pytorch] feat: 🔒 Enable networkPolicy (#22742)
* [bitnami/pytorch] feat: 🔒 Enable networkPolicy Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * fix: 🔧 Allow egress traffic to ports 80,443,22 Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> --------- Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
committed by
GitHub
GitHub
parent
e6542e9fc0
commit
903a6e8245
@@ -33,4 +33,4 @@ maintainers:
|
||||
name: pytorch
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/pytorch
|
||||
version: 3.6.1
|
||||
version: 3.7.0
|
||||
|
||||
@@ -170,20 +170,26 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Traffic Exposure Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ---------------------------------------------------------------------------------- | ----------- |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.ports.pytorch` | Scheduler Service port | `49875` |
|
||||
| `service.nodePorts.pytorch` | Node port for Pytorch | `""` |
|
||||
| `service.clusterIP` | Pytorch service Cluster IP | `""` |
|
||||
| `service.loadBalancerIP` | Pytorch service Load Balancer IP | `""` |
|
||||
| `service.loadBalancerSourceRanges` | Pytorch service Load Balancer sources | `[]` |
|
||||
| `service.externalTrafficPolicy` | Pytorch service external traffic policy | `Cluster` |
|
||||
| `service.annotations` | Additional custom annotations for Pytorch service | `{}` |
|
||||
| `service.extraPorts` | Extra ports to expose in Pytorch service (normally used with the `sidecars` value) | `[]` |
|
||||
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
|
||||
| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `service.headless.annotations` | Annotations for the headless service. | `{}` |
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ---------------------------------------------------------------------------------- | ----------- |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.ports.pytorch` | Scheduler Service port | `49875` |
|
||||
| `service.nodePorts.pytorch` | Node port for Pytorch | `""` |
|
||||
| `service.clusterIP` | Pytorch service Cluster IP | `""` |
|
||||
| `service.loadBalancerIP` | Pytorch service Load Balancer IP | `""` |
|
||||
| `service.loadBalancerSourceRanges` | Pytorch service Load Balancer sources | `[]` |
|
||||
| `service.externalTrafficPolicy` | Pytorch service external traffic policy | `Cluster` |
|
||||
| `service.annotations` | Additional custom annotations for Pytorch service | `{}` |
|
||||
| `service.extraPorts` | Extra ports to expose in Pytorch service (normally used with the `sidecars` value) | `[]` |
|
||||
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
|
||||
| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `service.headless.annotations` | Annotations for the headless service. | `{}` |
|
||||
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
|
||||
| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
|
||||
### Init Container Parameters
|
||||
|
||||
|
||||
75
bitnami/pytorch/templates/networkpolicy.yaml
Normal file
75
bitnami/pytorch/templates/networkpolicy.yaml
Normal file
@@ -0,0 +1,75 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow these ports to download models
|
||||
- port: 443
|
||||
- port: 80
|
||||
- port: 22
|
||||
# Allow internal communications between nodes
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.pytorch }}
|
||||
- port: {{ .Values.service.ports.pytorch }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.pytorch }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ include "common.names.fullname" . }}-client: "true"
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -463,6 +463,59 @@ service:
|
||||
##
|
||||
annotations: {}
|
||||
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
|
||||
## @section Init Container Parameters
|
||||
##
|
||||
|
||||
|
||||
Reference in New Issue
Block a user