From a88fd0a9e33b8325eb70f57806a7c380e09689f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Fri, 9 Feb 2024 10:20:17 +0100 Subject: [PATCH] [bitnami/cassandra] feat: :lock: Enable networkPolicy (#23335) * [bitnami/cassandra] feat: :lock: Enable networkPolicy Signed-off-by: Javier Salmeron Garcia * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers * fix: :bug: Add missing parethesis in helper function Signed-off-by: Javier Salmeron Garcia --------- Signed-off-by: Javier Salmeron Garcia Signed-off-by: Bitnami Containers Co-authored-by: Bitnami Containers --- bitnami/cassandra/Chart.yaml | 2 +- bitnami/cassandra/README.md | 41 +++++----- bitnami/cassandra/templates/NOTES.txt | 20 ++--- bitnami/cassandra/templates/_helpers.tpl | 8 +- .../cassandra/templates/cassandra-secret.yaml | 4 +- bitnami/cassandra/templates/headless-svc.yaml | 2 +- .../templates/metrics-configmap.yaml | 2 +- .../cassandra/templates/networkpolicy.yaml | 78 ++++++++++++++----- bitnami/cassandra/templates/pdb.yaml | 2 +- bitnami/cassandra/templates/service.yaml | 2 +- .../cassandra/templates/serviceaccount.yaml | 2 +- .../cassandra/templates/servicemonitor.yaml | 4 +- bitnami/cassandra/templates/statefulset.yaml | 2 +- bitnami/cassandra/templates/tls-secret.yaml | 4 +- bitnami/cassandra/values.yaml | 53 +++++++++++-- 15 files changed, 155 insertions(+), 71 deletions(-) diff --git a/bitnami/cassandra/Chart.yaml b/bitnami/cassandra/Chart.yaml index 7f4e8f2dfe..4e959501e9 100644 --- a/bitnami/cassandra/Chart.yaml +++ b/bitnami/cassandra/Chart.yaml @@ -32,4 +32,4 @@ maintainers: name: cassandra sources: - https://github.com/bitnami/charts/tree/main/bitnami/cassandra -version: 10.8.3 +version: 10.9.0 diff --git a/bitnami/cassandra/README.md b/bitnami/cassandra/README.md index ddead228a9..35f7ddfe0c 100644 --- a/bitnami/cassandra/README.md +++ b/bitnami/cassandra/README.md @@ -202,24 +202,29 @@ The command removes all the Kubernetes components associated with the chart and ### Traffic Exposure Parameters -| Name | Description | Value | -| ---------------------------------- | ----------------------------------------------------------------------------- | ----------- | -| `service.type` | Cassandra service type | `ClusterIP` | -| `service.ports.cql` | Cassandra service CQL Port | `9042` | -| `service.ports.metrics` | Cassandra service metrics port | `8080` | -| `service.nodePorts.cql` | Node port for CQL | `""` | -| `service.nodePorts.metrics` | Node port for metrics | `""` | -| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` | -| `service.loadBalancerIP` | LoadBalancerIP if service type is `LoadBalancer` | `""` | -| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | -| `service.clusterIP` | Service Cluster IP | `""` | -| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` | -| `service.annotations` | Provide any additional annotations which may be required. | `{}` | -| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `service.headless.annotations` | Annotations for the headless service. | `{}` | -| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| Name | Description | Value | +| --------------------------------------- | ---------------------------------------------------------------------------------- | ----------- | +| `service.type` | Cassandra service type | `ClusterIP` | +| `service.ports.cql` | Cassandra service CQL Port | `9042` | +| `service.ports.metrics` | Cassandra service metrics port | `8080` | +| `service.nodePorts.cql` | Node port for CQL | `""` | +| `service.nodePorts.metrics` | Node port for metrics | `""` | +| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` | +| `service.loadBalancerIP` | LoadBalancerIP if service type is `LoadBalancer` | `""` | +| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | +| `service.clusterIP` | Service Cluster IP | `""` | +| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` | +| `service.annotations` | Provide any additional annotations which may be required. | `{}` | +| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `service.headless.annotations` | Annotations for the headless service. | `{}` | +| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | +| `networkPolicy.allowExternal` | Don't require server label for connections | `true` | +| `networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | +| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` | +| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | +| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | ### Persistence parameters diff --git a/bitnami/cassandra/templates/NOTES.txt b/bitnami/cassandra/templates/NOTES.txt index 994177d728..fdedcdd38e 100644 --- a/bitnami/cassandra/templates/NOTES.txt +++ b/bitnami/cassandra/templates/NOTES.txt @@ -15,11 +15,11 @@ The chart has been deployed in diagnostic mode. All probes have been disabled an Get the list of pods by executing: - kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }} Access the pod you want to debug by executing - kubectl exec --namespace {{ .Release.Namespace }} -ti -- bash + kubectl exec --namespace {{ include "common.names.namespace" . }} -ti -- bash In order to replicate the container startup scripts execute this command: @@ -29,7 +29,7 @@ In order to replicate the container startup scripts execute this command: Cassandra can be accessed through the following URLs from within the cluster: - - CQL: {{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.ports.cql }} + - CQL: {{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.ports.cql }} To get your password run: @@ -37,13 +37,13 @@ To get your password run: Check the cluster status by running: - kubectl exec -it --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/name={{ include "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }} -o jsonpath='{.items[0].metadata.name}') nodetool status + kubectl exec -it --namespace {{ include "common.names.namespace" . }} $(kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/name={{ include "common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }} -o jsonpath='{.items[0].metadata.name}') nodetool status To connect to your Cassandra cluster using CQL: 1. Run a Cassandra pod that you can use as a client: - kubectl run --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' \ + kubectl run --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' \ --env CASSANDRA_PASSWORD=$CASSANDRA_PASSWORD \ {{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ include "common.names.name" . }}-client=true"{{ end }} \ --image {{ include "cassandra.image" . }} -- bash @@ -63,22 +63,22 @@ To connect to your database from outside the cluster execute the following comma {{- if contains "NodePort" .Values.service.type }} - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }}) cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD $NODE_IP $NODE_PORT {{- else if contains "LoadBalancer" .Values.service.type }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "common.names.fullname" . }}' + Watch the status with: 'kubectl get svc --namespace {{ include "common.names.namespace" . }} -w {{ include "common.names.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD $SERVICE_IP {{- else if contains "ClusterIP" .Values.service.type }} - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} {{ .Values.service.ports.cql }}:{{ .Values.service.ports.cql }} & + kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} {{ .Values.service.ports.cql }}:{{ .Values.service.ports.cql }} & cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD 127.0.0.1 {{ .Values.service.ports.cql }} {{- end }} diff --git a/bitnami/cassandra/templates/_helpers.tpl b/bitnami/cassandra/templates/_helpers.tpl index 2cca29ed57..f82e9223fb 100644 --- a/bitnami/cassandra/templates/_helpers.tpl +++ b/bitnami/cassandra/templates/_helpers.tpl @@ -50,7 +50,7 @@ Return the list of Cassandra seed nodes {{- define "cassandra.seeds" -}} {{- $seeds := list }} {{- $fullname := include "common.names.fullname" . }} -{{- $releaseNamespace := .Release.Namespace }} +{{- $releaseNamespace := include "common.names.namespace" . }} {{- $clusterDomain := .Values.clusterDomain }} {{- $seedCount := .Values.cluster.seedCount | int }} {{- range $e, $i := until $seedCount }} @@ -203,7 +203,7 @@ otherwise it generates a random value. {{- if .Values.dbUser.password }} {{- .Values.dbUser.password }} {{- else if (not .Values.dbUser.forcePassword) }} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "cassandra-password") -}} + {{- include "getValueFromSecret" (dict "Namespace" (include "common.names.namespace" .) "Name" (include "common.names.fullname" .) "Length" 10 "Key" "cassandra-password") -}} {{- else }} {{ required "A Cassandra Password is required!" .Values.dbUser.password }} {{- end }} @@ -213,7 +213,7 @@ otherwise it generates a random value. {{- if .Values.tls.keystorePassword }} {{- .Values.tls.keystorePassword }} {{- else }} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "Length" 10 "Key" "keystore-password") -}} + {{- include "getValueFromSecret" (dict "Namespace" (include "common.names.namespace" .) "Name" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "Length" 10 "Key" "keystore-password") -}} {{- end }} {{- end -}} @@ -221,7 +221,7 @@ otherwise it generates a random value. {{- if .Values.tls.truststorePassword }} {{- .Values.tls.truststorePassword }} {{- else }} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "Length" 10 "Key" "truststore-password") -}} + {{- include "getValueFromSecret" (dict "Namespace" (include "common.names.namespace" .) "Name" (printf "%s-%s" (include "common.names.fullname" .) "tls-pass" | trunc 63 | trimSuffix "-") "Length" 10 "Key" "truststore-password") -}} {{- end }} {{- end -}} diff --git a/bitnami/cassandra/templates/cassandra-secret.yaml b/bitnami/cassandra/templates/cassandra-secret.yaml index 847cad0bee..44908395ef 100644 --- a/bitnami/cassandra/templates/cassandra-secret.yaml +++ b/bitnami/cassandra/templates/cassandra-secret.yaml @@ -8,7 +8,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} @@ -23,7 +23,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ printf "%s-tls-pass" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} diff --git a/bitnami/cassandra/templates/headless-svc.yaml b/bitnami/cassandra/templates/headless-svc.yaml index a9f77d28e9..9c9b2b8c0b 100644 --- a/bitnami/cassandra/templates/headless-svc.yaml +++ b/bitnami/cassandra/templates/headless-svc.yaml @@ -7,7 +7,7 @@ apiVersion: v1 kind: Service metadata: name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.service.headless.annotations .Values.commonAnnotations }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} diff --git a/bitnami/cassandra/templates/metrics-configmap.yaml b/bitnami/cassandra/templates/metrics-configmap.yaml index 12595a213a..612513b4ff 100644 --- a/bitnami/cassandra/templates/metrics-configmap.yaml +++ b/bitnami/cassandra/templates/metrics-configmap.yaml @@ -7,7 +7,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ printf "%s-metrics-conf" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} app.kubernetes.io/part-of: cassandra app.kubernetes.io/component: cassandra-exporter diff --git a/bitnami/cassandra/templates/networkpolicy.yaml b/bitnami/cassandra/templates/networkpolicy.yaml index 7182dd866c..1ca8aa2505 100644 --- a/bitnami/cassandra/templates/networkpolicy.yaml +++ b/bitnami/cassandra/templates/networkpolicy.yaml @@ -8,7 +8,7 @@ kind: NetworkPolicy apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} @@ -17,30 +17,66 @@ spec: {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }} podSelector: matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} - ingress: - # Allow inbound connections - # CQL port + policyTypes: + - Ingress + - Egress + {{- if .Values.networkPolicy.allowExternalEgress }} + egress: + - {} + {{- else }} + egress: + # Allow dns resolution - ports: - - port: {{ .Values.service.ports.cql }} - from: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + # Allow connection to other cluster pods + - ports: + - port: {{ .Values.containerPorts.cql }} + - port: {{ .Values.containerPorts.jmx }} + - port: {{ .Values.containerPorts.tls }} + - port: {{ .Values.containerPorts.intra }} + to: + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + {{- if .Values.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + ingress: + - ports: + - port: {{ .Values.containerPorts.cql }} + - port: {{ .Values.containerPorts.jmx }} + - port: {{ .Values.containerPorts.tls }} + - port: {{ .Values.containerPorts.intra }} + {{- if .Values.metrics.enabled }} + - port: {{ .Values.metrics.containerPorts.http }} + - port: {{ .Values.metrics.containerPorts.jmx }} + {{- end }} {{- if not .Values.networkPolicy.allowExternal }} + from: - podSelector: matchLabels: - {{ include "common.names.fullname" . }}-client: "true" - {{- end }} - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} - # Internal ports - - ports: - - port: intra - - port: tls - - port: jmx - from: + {{ template "common.names.fullname" . }}-client: "true" - podSelector: - matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }} - {{- if .Values.metrics.enabled }} - # Allow prometheus scrapes for metrics - - ports: - - port: {{ .Values.metrics.containerPorts.http | default "8080" }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }} + {{- if .Values.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: + {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- if .Values.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }} {{- end }} {{- end }} diff --git a/bitnami/cassandra/templates/pdb.yaml b/bitnami/cassandra/templates/pdb.yaml index 07c37776a0..a02d402124 100644 --- a/bitnami/cassandra/templates/pdb.yaml +++ b/bitnami/cassandra/templates/pdb.yaml @@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} kind: PodDisruptionBudget metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} diff --git a/bitnami/cassandra/templates/service.yaml b/bitnami/cassandra/templates/service.yaml index 1dbb251a6f..270a7917d4 100644 --- a/bitnami/cassandra/templates/service.yaml +++ b/bitnami/cassandra/templates/service.yaml @@ -7,7 +7,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.service.annotations .Values.commonAnnotations }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }} diff --git a/bitnami/cassandra/templates/serviceaccount.yaml b/bitnami/cassandra/templates/serviceaccount.yaml index 24e9b6984a..b167a160f6 100644 --- a/bitnami/cassandra/templates/serviceaccount.yaml +++ b/bitnami/cassandra/templates/serviceaccount.yaml @@ -8,7 +8,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "cassandra.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} diff --git a/bitnami/cassandra/templates/servicemonitor.yaml b/bitnami/cassandra/templates/servicemonitor.yaml index 08748490f8..6271dbbc7f 100644 --- a/bitnami/cassandra/templates/servicemonitor.yaml +++ b/bitnami/cassandra/templates/servicemonitor.yaml @@ -8,7 +8,7 @@ apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }} + namespace: {{ default include "common.names.namespace" . .Values.metrics.serviceMonitor.namespace | quote }} {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} {{- if .Values.metrics.serviceMonitor.additionalLabels }} @@ -45,5 +45,5 @@ spec: {{- end }} namespaceSelector: matchNames: - - {{ .Release.Namespace }} + - {{ include "common.names.namespace" . }} {{- end }} diff --git a/bitnami/cassandra/templates/statefulset.yaml b/bitnami/cassandra/templates/statefulset.yaml index f17c4279ec..8b16bea4ba 100644 --- a/bitnami/cassandra/templates/statefulset.yaml +++ b/bitnami/cassandra/templates/statefulset.yaml @@ -7,7 +7,7 @@ apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} kind: StatefulSet metadata: name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} diff --git a/bitnami/cassandra/templates/tls-secret.yaml b/bitnami/cassandra/templates/tls-secret.yaml index 56722c8e3b..47217082fa 100644 --- a/bitnami/cassandra/templates/tls-secret.yaml +++ b/bitnami/cassandra/templates/tls-secret.yaml @@ -7,7 +7,7 @@ SPDX-License-Identifier: APACHE-2.0 {{- $secretName := printf "%s-crt" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} {{- $ca := genCA "cassandra-ca" 365 }} {{- $fullname := include "common.names.fullname" . }} -{{- $releaseNamespace := .Release.Namespace }} +{{- $releaseNamespace := include "common.names.namespace" . }} {{- $clusterDomain := .Values.clusterDomain }} {{- $serviceName := include "common.names.fullname" . }} {{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} @@ -17,7 +17,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ $secretName }} - namespace: {{ .Release.Namespace | quote }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} diff --git a/bitnami/cassandra/values.yaml b/bitnami/cassandra/values.yaml index 4a138a7793..ad0d1ceb20 100644 --- a/bitnami/cassandra/values.yaml +++ b/bitnami/cassandra/values.yaml @@ -553,20 +553,63 @@ service: ## @param service.headless.annotations Annotations for the headless service. ## annotations: {} -## Network policies + +## Network Policies ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ ## networkPolicy: ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created ## - enabled: false - ## @param networkPolicy.allowExternal Don't require client label for connections + enabled: true + ## @param networkPolicy.allowExternal Don't require server label for connections ## The Policy model to apply. When set to false, only pods with the correct - ## client label will have network access to the port Redis® is listening - ## on. When true, Redis® will accept connections from any source + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source ## (with the correct destination port). ## allowExternal: true + ## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## @section Persistence parameters ##