Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-01 06:58:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/postgresql-ha] Add network egress policy rules (#8358)

Browse Source
This commit is contained in:
Davide Madrisan
2021-12-10 11:30:55 +01:00
committed by GitHub
parent b547831b78
commit f60cd38551
5 changed files with 66 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bitnami/postgresql-ha/Chart.yaml
View File

@@ -27,4 +27,4 @@ name: postgresql-ha
sources:
- https://github.com/bitnami/bitnami-docker-postgresql
- https://www.postgresql.org/
version: 8.0.5
version: 8.1.0

30
bitnami/postgresql-ha/README.md
View File

@@ -404,20 +404,22 @@ Additionally, if `persistence.resourcePolicy` is set to `keep`, you should manua
### Traffic Exposure parameters
| Name | Description | Value |
| ---------------------------------- | ------------------------------------------------------------------- | ----------- |
| `service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` |
| `service.port` | PostgreSQL port | `5432` |
| `service.nodePort` | Kubernetes service nodePort | `""` |
| `service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` |
| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` |
| `service.clusterIP` | Set the Cluster IP to use | `""` |
| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
| `service.annotations` | Provide any additional annotations for PostgreSQL service | `{}` |
| `service.serviceLabels` | Labels for PostgreSQL service | `{}` |
| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| Name | Description | Value |
| ----------------------------------------------------- | --------------------------------------------------------------------------------------------- | ----------- |
| `service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` |
| `service.port` | PostgreSQL port | `5432` |
| `service.nodePort` | Kubernetes service nodePort | `""` |
| `service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` |
| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` |
| `service.clusterIP` | Set the Cluster IP to use | `""` |
| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
| `service.annotations` | Provide any additional annotations for PostgreSQL service | `{}` |
| `service.serviceLabels` | Labels for PostgreSQL service | `{}` |
| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| `networkPolicy.egressRules.denyConnectionsToExternal` | Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53) | `false` |
| `networkPolicy.egressRules.customRules` | Custom network policy rule | `{}` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

32
bitnami/postgresql-ha/templates/networkpolicy-egress.yaml Normal file
View File

@@ -0,0 +1,32 @@
{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.egressRules.denyConnectionsToExternal .Values.networkPolicy.egressRules.customRules) }}
kind: NetworkPolicy
apiVersion: {{ template "postgresql-ha.networkPolicy.apiVersion" . }}
metadata:
name: {{ printf "%s-egress" (include "common.names.fullname" .) }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
podSelector:
matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: postgresql
policyTypes:
- Egress
egress:
{{- if .Values.networkPolicy.egressRules.denyConnectionsToExternal }}
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
- to:
- namespaceSelector: {}
{{- end }}
{{- if .Values.networkPolicy.egressRules.customRules }}
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }}
{{- end }}
{{- end }}

4
bitnami/postgresql-ha/templates/networkpolicy.yaml → bitnami/postgresql-ha/templates/networkpolicy-ingress.yaml
View File

@@ -2,7 +2,7 @@
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ include "common.names.fullname" . }}
name: {{ printf "%s-ingress" (include "common.names.fullname" .) }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
@@ -14,6 +14,8 @@ spec:
podSelector:
matchLabels: {{ include "common.labels.matchLabels" . | nindent 6 }}
app.kubernetes.io/component: postgresql
policyTypes:
- Ingress
ingress:
# Allow inbound connections
- ports:

14
bitnami/postgresql-ha/values.yaml
View File

@@ -1359,3 +1359,17 @@ networkPolicy:
## (with the correct destination port).
##
allowExternal: true
## @param networkPolicy.egressRules.denyConnectionsToExternal Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53)
## @param networkPolicy.egressRules.customRules [object] Custom network policy rule
##
egressRules:
# Deny connections to external. This is not compatible with an external database.
denyConnectionsToExternal: false
## Additional custom egress rules
## e.g:
## customRules:
## - to:
## - namespaceSelector:
## matchLabels:
## label: example
customRules: []