mirror of
https://github.com/bitnami/charts.git
synced 2026-03-29 16:27:11 +08:00
[bitnami/milvus] feat: 🔒 Enable networkPolicy (#22923)
* [bitnami/milvus] feat: 🔒 Enable networkPolicy Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * fix: 🐛 Add allowExternalEgress to avoid breaking istio Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com> * fix: 🐛 Set proper ports Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> --------- Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com> Signed-off-by: Javier J. Salmerón-García <jsalmeron@vmware.com> Co-authored-by: Bitnami Containers <bitnami-bot@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
committed by
GitHub
GitHub
parent
5157636e97
commit
965c6bee34
@@ -26,6 +26,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.attu.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,35 +37,30 @@ spec:
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
# Allow outbound connections to Milvus Proxy
|
||||
- ports:
|
||||
- port: {{ .Values.attu.service.ports.http }}
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
app.kubernetes.io/component: proxy
|
||||
{{- if .Values.attu.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.attu.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.attu.service.ports.http }}
|
||||
- port: {{ .Values.attu.containerPorts.http }}
|
||||
{{- if not .Values.attu.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.attu.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -76,6 +75,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.attu.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.attu.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.attu.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,35 +37,68 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataCoord.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dataCoord.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
{{- if .Values.dataCoord.metrics.enabled }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.dataCoord.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.dataCoord.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -76,10 +113,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataCoord.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.dataCoord.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataCoord.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dataCoord.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.dataNode.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,67 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataNode.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dataNode.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
{{- if .Values.dataNode.metrics.enabled }}
|
||||
- port: {{ .Values.dataNode.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.dataNode.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.dataNode.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +112,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataNode.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.dataNode.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.dataNode.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dataNode.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.indexCoord.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,67 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexCoord.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.indexCoord.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
{{- if .Values.indexCoord.metrics.enabled }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.indexCoord.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.indexCoord.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +112,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexCoord.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.indexCoord.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexCoord.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.indexCoord.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.indexNode.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,64 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexNode.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.indexNode.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
{{- if .Values.indexNode.metrics.enabled }}
|
||||
- port: {{ .Values.indexNode.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.indexNode.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.indexNode.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +109,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexNode.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.indexNode.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.indexNode.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.indexNode.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
55
bitnami/milvus/templates/init-job-networkpolicy.yaml
Normal file
55
bitnami/milvus/templates/init-job-networkpolicy.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.initJob.networkPolicy.enabled (include "milvus.init-job.create" .) }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}-init
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.initJob.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
app.kubernetes.io/component: initJob
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.initJob.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
app.kubernetes.io/component: init
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.initJob.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to Milvus Proxy
|
||||
- ports:
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.initJob.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initJob.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.initJob.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initJob.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -13,6 +13,7 @@ metadata:
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
app.kubernetes.io/component: init
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.initJob.annotations "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
@@ -23,6 +24,7 @@ spec:
|
||||
metadata:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.initJob.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
app.kubernetes.io/component: init
|
||||
{{- if .Values.initJob.podAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.initJob.podAnnotations "context" $) | nindent 8 }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.proxy.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,68 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.proxy.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
{{- if .Values.proxy.metrics.enabled }}
|
||||
- port: {{ .Values.proxy.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.proxy.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +113,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.proxy.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.proxy.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.queryCoord.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,64 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryCoord.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.queryCoord.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
{{- if .Values.queryCoord.metrics.enabled }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.queryCoord.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.queryCoord.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +109,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryCoord.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryCoord.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.queryCoord.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.queryNode.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,67 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryNode.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.queryNode.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
{{- if .Values.queryNode.metrics.enabled }}
|
||||
- port: {{ .Values.queryNode.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.queryNode.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: milvus
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.queryNode.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +112,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryNode.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.queryNode.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.queryNode.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.queryNode.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,6 +24,10 @@ spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.rootCoord.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
@@ -33,32 +37,64 @@ spec:
|
||||
protocol: TCP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.queryCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.dataCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.indexCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.queryNode.service.ports.grpc }}
|
||||
- port: {{ .Values.dataNode.service.ports.grpc }}
|
||||
- port: {{ .Values.indexNode.service.ports.grpc }}
|
||||
- port: {{ .Values.proxy.service.ports.grpc }}
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
- port: {{ .Values.queryCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
- port: {{ .Values.queryNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.dataNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.indexNode.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpc }}
|
||||
- port: {{ .Values.proxy.containerPorts.grpcInternal }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
# Allow outbound connections to S3
|
||||
- ports:
|
||||
- port: {{ include "milvus.s3.port" . }}
|
||||
{{- if .Values.minio.enabled }}
|
||||
- port: {{ .Values.minio.containerPorts.api }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: minio
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to etcd
|
||||
- ports:
|
||||
- port: {{ include "milvus.etcd.port" . }}
|
||||
to:
|
||||
{{- if .Values.etcd.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to kafka
|
||||
- ports:
|
||||
- port: {{ include "milvus.kafka.port" . }}
|
||||
to:
|
||||
{{- if .Values.kafka.enabled }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kafka
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.rootCoord.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rootCoord.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.rootCoord.service.ports.grpc }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.grpc }}
|
||||
{{- if .Values.rootCoord.metrics.enabled }}
|
||||
- port: {{ .Values.rootCoord.containerPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if not .Values.rootCoord.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.rootCoord.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -73,10 +109,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.rootCoord.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.rootCoord.service.ports.metrics }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.rootCoord.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rootCoord.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
Reference in New Issue
Block a user