Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-16 06:47:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/prometheus] feat: 🔒 Enable networkPolicy (#22745)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-30 16:07:19 +01:00
committed by GitHub
parent f1c7b0d6c6
commit 94ef9a9434
5 changed files with 250 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/prometheus/Chart.yaml
View File

@@ -35,4 +35,4 @@ sources:
- https://github.com/bitnami/containers/tree/main/bitnami/prometheus
- https://github.com/prometheus/prometheus
- https://github.com/prometheus-community/helm-charts
version: 0.7.1
version: 0.8.0

12
bitnami/prometheus/README.md
View File

@@ -184,6 +184,12 @@ The command removes all the Kubernetes components associated with the chart and
| `alertmanager.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `alertmanager.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `alertmanager.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
| `alertmanager.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `alertmanager.networkPolicy.allowExternal` | Don't require alertmanager label for connections | `true` |
| `alertmanager.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
| `alertmanager.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `alertmanager.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `alertmanager.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
| `alertmanager.service.type` | Alertmanager service type | `LoadBalancer` |
| `alertmanager.service.ports.http` | Alertmanager service HTTP port | `80` |
| `alertmanager.service.ports.cluster` | Alertmanager cluster HA port | `9094` |
@@ -382,6 +388,12 @@ The command removes all the Kubernetes components associated with the chart and
| `server.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `server.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `server.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
| `server.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `server.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `server.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
| `server.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `server.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `server.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
| `server.service.type` | Prometheus service type | `LoadBalancer` |
| `server.service.ports.http` | Prometheus service HTTP port | `80` |
| `server.service.nodePorts.http` | Node port for HTTP | `""` |

63
bitnami/prometheus/templates/alertmanager/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,63 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.alertmanager.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "prometheus.alertmanager.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: prometheus
app.kubernetes.io/component: alertmanager
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.alertmanager.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: prometheus
app.kubernetes.io/component: alertmanager
policyTypes:
- Ingress
- Egress
{{/* As we cannot easily identify the targets of AlertManager we allow all egress traffic by default */}}
{{- if .Values.alertmanager.networkPolicy.extraEgress }}
egress: {{- include "common.tplvalues.render" ( dict "value" .Values.alertmanager.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- else }}
egress:
- {}
{{- end }}
ingress:
- ports:
- port: {{ .Values.alertmanager.containerPorts.http }}
- port: {{ .Values.alertmanager.service.ports.http }}
{{- if not .Values.alertmanager.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
- podSelector:
matchLabels:
{{ template "prometheus.alertmanager.fullname" . }}-client: "true"
{{- if .Values.alertmanager.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.alertmanager.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.alertmanager.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.alertmanager.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.alertmanager.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.alertmanager.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

68
bitnami/prometheus/templates/server/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,68 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.server.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "prometheus.server.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/part-of: prometheus
app.kubernetes.io/component: server
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.server.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/part-of: prometheus
app.kubernetes.io/component: server
policyTypes:
- Ingress
- Egress
{{/* As we cannot easily identify the ports of the metrics exporters (each exporter has its own port), we allow all egress traffic by default */}}
{{- if .Values.server.networkPolicy.extraEgress }}
egress: {{- include "common.tplvalues.render" ( dict "value" .Values.server.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- else }}
egress:
- {}
{{- end }}
ingress:
- ports:
- port: {{ .Values.server.containerPorts.http }}
- port: {{ .Values.server.service.ports.http }}
{{- if .Values.server.thanos.create }}
{{/* We currently don't allow modifying thanos ports */}}
- port: 10901
- port: 10902
{{- end }}
{{- if not .Values.server.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
- podSelector:
matchLabels:
{{ template "prometheus.server.fullname" . }}-client: "true"
{{- if .Values.server.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.server.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.server.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.server.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.server.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.server.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

106
bitnami/prometheus/values.yaml
View File

@@ -495,6 +495,59 @@ alertmanager:
##
automountServiceAccountToken: false
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param alertmanager.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param alertmanager.networkPolicy.allowExternal Don't require alertmanager label for connections
## The Policy model to apply. When set to false, only pods with the correct
## alertmanager label will have network access to the ports alertmanager is listening
## on. When true, alertmanager will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param alertmanager.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param alertmanager.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param alertmanager.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param alertmanager.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## Alertmanager service parameters
##
service:
@@ -1396,6 +1449,59 @@ server:
##
automountServiceAccountToken: false
## Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param server.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: true
## @param server.networkPolicy.allowExternal Don't require server label for connections
## The Policy model to apply. When set to false, only pods with the correct
## server label will have network access to the ports server is listening
## on. When true, server will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param server.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param server.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param server.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param server.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## Prometheus service parameters
##
service: