Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-15 06:47:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/appsmith] Add Network Policies (#22221)

Browse Source 
Signed-off-by: Alvaro Neira Ayuso <alvaron@vmware.com>
This commit is contained in:
Alvaro Neira Ayuso
2024-01-19 12:31:33 +01:00
committed by GitHub
parent 5dd5bd6d0d
commit b7ad991f66
6 changed files with 406 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/appsmith/Chart.yaml
View File

@@ -37,4 +37,4 @@ maintainers:
name: appsmith
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/appsmith
version: 2.2.2
version: 2.3.0

33
bitnami/appsmith/README.md
View File

@@ -159,6 +159,17 @@ The command removes all the Kubernetes components associated with the chart and
| `client.sidecars` | Add additional sidecar containers to the Appsmith client pod(s) | `[]` |
| `client.initContainers` | Add additional init containers to the Appsmith client pod(s) | `[]` |
### Appsmith Client Network Policies
| Name | Description | Value |
| ---------------------------------------------- | ---------------------------------------------------------- | ------- |
| `client.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` |
| `client.networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| `client.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
| `client.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `client.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `client.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
### Appsmith Client Traffic Exposure Parameters
| Name | Description | Value |
@@ -268,6 +279,17 @@ The command removes all the Kubernetes components associated with the chart and
| `backend.sidecars` | Add additional sidecar containers to the Appsmith backend pod(s) | `[]` |
| `backend.initContainers` | Add additional init containers to the Appsmith backend pod(s) | `[]` |
### Appsmith Backend Network Policies
| Name | Description | Value |
| ----------------------------------------------- | ---------------------------------------------------------- | ------- |
| `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` |
| `backend.networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| `backend.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolic | `[]` |
| `backend.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `backend.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `backend.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
### Appsmith Backend Traffic Exposure Parameters
| Name | Description | Value |
@@ -370,6 +392,17 @@ The command removes all the Kubernetes components associated with the chart and
| `rts.sidecars` | Add additional sidecar containers to the Appsmith rts pod(s) | `[]` |
| `rts.initContainers` | Add additional init containers to the Appsmith rts pod(s) | `[]` |
### Appsmith RTS Network Policies
| Name | Description | Value |
| ------------------------------------------- | ---------------------------------------------------------- | ------- |
| `rts.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` |
| `rts.networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| `rts.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
| `rts.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `rts.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `rts.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
### Appsmith RTS Traffic Exposure Parameters
| Name | Description | Value |

72
bitnami/appsmith/templates/backend/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,72 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.backend.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "appsmith.backend.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: backend
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backend.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: backend
policyTypes:
- Ingress
- Egress
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to other cluster pods
- ports:
- port: {{ .Values.backend.service.ports.http}}
- port: {{ .Values.rts.containerPorts.http }}
- port: {{ .Values.backend.containerPorts.http }}
- port: {{ include "appsmith.redis.port" . }}
- port: {{ include "appsmith.mongodb.port" . }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
{{- if .Values.backend.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.backend.containerPorts.http }}
- port: {{ .Values.backend.service.ports.http}}
{{- if not .Values.backend.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels:
{{ template "appsmith.backend.fullname" . }}-client: "true"
{{- if .Values.backend.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.backend.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.backend.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.backend.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.backend.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.backend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

71
bitnami/appsmith/templates/client/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,71 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.client.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: client
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.client.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: client
policyTypes:
- Ingress
- Egress
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to other cluster pods
- ports:
- port: {{ .Values.backend.service.ports.http }}
- port: {{ .Values.rts.service.ports.http }}
- port: {{ .Values.client.containerPorts.http }}
- port: {{ .Values.client.service.ports.http }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
{{- if .Values.client.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.client.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.client.containerPorts.http }}
- port: {{ .Values.client.service.ports.http }}
{{- if not .Values.client.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels:
{{ template "common.names.fullname" . }}-client: "true"
{{- if .Values.client.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.client.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.client.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.client.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.client.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.client.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

70
bitnami/appsmith/templates/rts/networkpolicy.yaml Normal file
View File

@@ -0,0 +1,70 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.rts.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "appsmith.rts.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: rts
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.rts.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: rts
policyTypes:
- Ingress
- Egress
egress:
# Allow dns resolution
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow outbound connections to other cluster pods
- ports:
- port: {{ .Values.rts.service.ports.http }}
- port: {{ .Values.backend.service.ports.http }}
- port: {{ include "appsmith.mongodb.port" . }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
{{- if .Values.rts.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
ingress:
- ports:
- port: {{ .Values.rts.containerPorts.http }}
- port: {{ .Values.rts.service.ports.http }}
{{- if not .Values.rts.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels:
{{ template "appsmith.rts.fullname" . }}-client: "true"
{{- if .Values.rts.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.rts.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.rts.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.rts.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.rts.networkPolicy.extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.rts.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

159
bitnami/appsmith/values.yaml
View File

@@ -330,6 +330,59 @@ client:
##
initContainers: []
## @section Appsmith Client Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param client.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: false
## @param client.networkPolicy.allowExternal Don't require client label for connections
## The Policy model to apply. When set to false, only pods with the correct
## client label will have network access to the ports AppSmith Client is listening
## on. When true, AppSmith Client will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param client.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param client.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param client.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param client.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Appsmith Client Traffic Exposure Parameters
##
service:
@@ -753,6 +806,59 @@ backend:
##
initContainers: []
## @section Appsmith Backend Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param backend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: false
## @param backend.networkPolicy.allowExternal Don't require client label for connections
## The Policy model to apply. When set to false, only pods with the correct
## client label will have network access to the ports AppSmith Backend is listening
## on. When true, AppSmith Backend will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param backend.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolic
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param backend.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param backend.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param backend.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Appsmith Backend Traffic Exposure Parameters
##
service:
@@ -1095,6 +1201,59 @@ rts:
##
initContainers: []
## @section Appsmith RTS Network Policies
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
##
networkPolicy:
## @param rts.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
##
enabled: false
## @param rts.networkPolicy.allowExternal Don't require client label for connections
## The Policy model to apply. When set to false, only pods with the correct
## client label will have network access to the ports AppSmith RTS is listening
## on. When true, AppSmith RTS will accept connections from any source
## (with the correct destination port).
##
allowExternal: true
## @param rts.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
## e.g:
## extraIngress:
## - ports:
## - port: 1234
## from:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
extraIngress: []
## @param rts.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
## e.g:
## extraEgress:
## - ports:
## - port: 1234
## to:
## - podSelector:
## - matchLabels:
## - role: frontend
## - podSelector:
## - matchExpressions:
## - key: role
## operator: In
## values:
## - frontend
##
extraEgress: []
## @param rts.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
## @param rts.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
##
ingressNSMatchLabels: {}
ingressNSPodMatchLabels: {}
## @section Appsmith RTS Traffic Exposure Parameters
##
service: