mirror of
https://github.com/bitnami/charts.git
synced 2026-03-05 14:57:31 +08:00
[bitnami/kuberay] feat: 🔒 Enable networkPolicy (#23076)
* [bitnami/kuberay] feat: 🔒 Enable networkPolicy Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * fix: 🐛 Add missing reference to allowExternalEgress Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> --------- Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> Signed-off-by: Javier J. Salmerón-García <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
committed by
GitHub
GitHub
parent
c76adeac0c
commit
fb8522ee5e
@@ -32,4 +32,4 @@ maintainers:
|
||||
name: kuberay
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/kuberay
|
||||
version: 0.3.4
|
||||
version: 0.4.0
|
||||
|
||||
@@ -181,33 +181,41 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Kuberay Operator Traffic Exposure Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `operator.service.type` | Kuberay Operator service type | `ClusterIP` |
|
||||
| `operator.service.ports.metrics` | Kuberay Operator service HTTP port | `80` |
|
||||
| `operator.service.nodePorts.metrics` | Node port for HTTP | `""` |
|
||||
| `operator.service.clusterIP` | Kuberay Operator service Cluster IP | `""` |
|
||||
| `operator.service.loadBalancerIP` | Kuberay Operator service Load Balancer IP | `""` |
|
||||
| `operator.service.loadBalancerSourceRanges` | Kuberay Operator service Load Balancer sources | `[]` |
|
||||
| `operator.service.externalTrafficPolicy` | Kuberay Operator service external traffic policy | `Cluster` |
|
||||
| `operator.service.annotations` | Additional custom annotations for Kuberay Operator service | `{}` |
|
||||
| `operator.service.extraPorts` | Extra ports to expose in Kuberay Operator service (normally used with the `sidecars` value) | `[]` |
|
||||
| `operator.service.sessionAffinity` | Control where web requests go, to the same pod or round-robin | `None` |
|
||||
| `operator.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `operator.ingress.enabled` | Enable ingress record generation for Kuberay | `false` |
|
||||
| `operator.ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `operator.ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `operator.ingress.hostname` | Default host for the ingress record | `kuberay-operator.local` |
|
||||
| `operator.ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `operator.ingress.path` | Default path for the ingress record | `/` |
|
||||
| `operator.ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `operator.ingress.tls` | Enable TLS configuration for the host defined at `client.ingress.hostname` parameter | `false` |
|
||||
| `operator.ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `operator.ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `operator.ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
|
||||
| `operator.ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
|
||||
| `operator.ingress.secrets` | Custom TLS certificates as secrets | `[]` |
|
||||
| `operator.ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `operator.service.type` | Kuberay Operator service type | `ClusterIP` |
|
||||
| `operator.service.ports.metrics` | Kuberay Operator service HTTP port | `80` |
|
||||
| `operator.service.nodePorts.metrics` | Node port for HTTP | `""` |
|
||||
| `operator.service.clusterIP` | Kuberay Operator service Cluster IP | `""` |
|
||||
| `operator.service.loadBalancerIP` | Kuberay Operator service Load Balancer IP | `""` |
|
||||
| `operator.service.loadBalancerSourceRanges` | Kuberay Operator service Load Balancer sources | `[]` |
|
||||
| `operator.service.externalTrafficPolicy` | Kuberay Operator service external traffic policy | `Cluster` |
|
||||
| `operator.service.annotations` | Additional custom annotations for Kuberay Operator service | `{}` |
|
||||
| `operator.service.extraPorts` | Extra ports to expose in Kuberay Operator service (normally used with the `sidecars` value) | `[]` |
|
||||
| `operator.service.sessionAffinity` | Control where web requests go, to the same pod or round-robin | `None` |
|
||||
| `operator.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `operator.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `operator.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `operator.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `operator.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `operator.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
|
||||
| `operator.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `operator.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `operator.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `operator.ingress.enabled` | Enable ingress record generation for Kuberay | `false` |
|
||||
| `operator.ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `operator.ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `operator.ingress.hostname` | Default host for the ingress record | `kuberay-operator.local` |
|
||||
| `operator.ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `operator.ingress.path` | Default path for the ingress record | `/` |
|
||||
| `operator.ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `operator.ingress.tls` | Enable TLS configuration for the host defined at `client.ingress.hostname` parameter | `false` |
|
||||
| `operator.ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `operator.ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `operator.ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
|
||||
| `operator.ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
|
||||
| `operator.ingress.secrets` | Custom TLS certificates as secrets | `[]` |
|
||||
| `operator.ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
|
||||
|
||||
### Kuberay Operator RBAC Parameters
|
||||
|
||||
@@ -335,35 +343,43 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Kuberay API Server Traffic Exposure Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `apiserver.service.type` | Kuberay API Server service type | `ClusterIP` |
|
||||
| `apiserver.service.ports.http` | Kuberay API Server service HTTP port | `80` |
|
||||
| `apiserver.service.ports.grpc` | Kuberay API Server service HTTP port | `8887` |
|
||||
| `apiserver.service.nodePorts.http` | Node port for HTTP | `""` |
|
||||
| `apiserver.service.nodePorts.grpc` | Node port for GRPC | `""` |
|
||||
| `apiserver.service.clusterIP` | Kuberay API Server service Cluster IP | `""` |
|
||||
| `apiserver.service.loadBalancerIP` | Kuberay API Server service Load Balancer IP | `""` |
|
||||
| `apiserver.service.loadBalancerSourceRanges` | Kuberay API Server service Load Balancer sources | `[]` |
|
||||
| `apiserver.service.externalTrafficPolicy` | Kuberay API Server service external traffic policy | `Cluster` |
|
||||
| `apiserver.service.annotations` | Additional custom annotations for Kuberay API Server service | `{}` |
|
||||
| `apiserver.service.extraPorts` | Extra ports to expose in Kuberay API Server service (normally used with the `sidecars` value) | `[]` |
|
||||
| `apiserver.service.sessionAffinity` | Control where web requests go, to the same pod or round-robin | `None` |
|
||||
| `apiserver.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `apiserver.ingress.enabled` | Enable ingress record generation for Kuberay | `false` |
|
||||
| `apiserver.ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `apiserver.ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `apiserver.ingress.hostname` | Default host for the ingress record | `kuberay-apiserver.local` |
|
||||
| `apiserver.ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `apiserver.ingress.path` | Default path for the ingress record | `/` |
|
||||
| `apiserver.ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `apiserver.ingress.tls` | Enable TLS configuration for the host defined at `client.ingress.hostname` parameter | `false` |
|
||||
| `apiserver.ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `apiserver.ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `apiserver.ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
|
||||
| `apiserver.ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
|
||||
| `apiserver.ingress.secrets` | Custom TLS certificates as secrets | `[]` |
|
||||
| `apiserver.ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `apiserver.service.type` | Kuberay API Server service type | `ClusterIP` |
|
||||
| `apiserver.service.ports.http` | Kuberay API Server service HTTP port | `80` |
|
||||
| `apiserver.service.ports.grpc` | Kuberay API Server service HTTP port | `8887` |
|
||||
| `apiserver.service.nodePorts.http` | Node port for HTTP | `""` |
|
||||
| `apiserver.service.nodePorts.grpc` | Node port for GRPC | `""` |
|
||||
| `apiserver.service.clusterIP` | Kuberay API Server service Cluster IP | `""` |
|
||||
| `apiserver.service.loadBalancerIP` | Kuberay API Server service Load Balancer IP | `""` |
|
||||
| `apiserver.service.loadBalancerSourceRanges` | Kuberay API Server service Load Balancer sources | `[]` |
|
||||
| `apiserver.service.externalTrafficPolicy` | Kuberay API Server service external traffic policy | `Cluster` |
|
||||
| `apiserver.service.annotations` | Additional custom annotations for Kuberay API Server service | `{}` |
|
||||
| `apiserver.service.extraPorts` | Extra ports to expose in Kuberay API Server service (normally used with the `sidecars` value) | `[]` |
|
||||
| `apiserver.service.sessionAffinity` | Control where web requests go, to the same pod or round-robin | `None` |
|
||||
| `apiserver.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `apiserver.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `apiserver.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `apiserver.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `apiserver.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `apiserver.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolice | `[]` |
|
||||
| `apiserver.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `apiserver.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `apiserver.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `apiserver.ingress.enabled` | Enable ingress record generation for Kuberay | `false` |
|
||||
| `apiserver.ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `apiserver.ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `apiserver.ingress.hostname` | Default host for the ingress record | `kuberay-apiserver.local` |
|
||||
| `apiserver.ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `apiserver.ingress.path` | Default path for the ingress record | `/` |
|
||||
| `apiserver.ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `apiserver.ingress.tls` | Enable TLS configuration for the host defined at `client.ingress.hostname` parameter | `false` |
|
||||
| `apiserver.ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `apiserver.ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `apiserver.ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` |
|
||||
| `apiserver.ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` |
|
||||
| `apiserver.ingress.secrets` | Custom TLS certificates as secrets | `[]` |
|
||||
| `apiserver.ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
|
||||
|
||||
### Kuberay API Server RBAC Parameters
|
||||
|
||||
|
||||
92
bitnami/kuberay/templates/apiserver/networkpolicy.yaml
Normal file
92
bitnami/kuberay/templates/apiserver/networkpolicy.yaml
Normal file
@@ -0,0 +1,92 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.apiserver.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "kuberay.apiserver.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apiserver
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.apiserver.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
app.kubernetes.io/component: apiserver
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.apiserver.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
- ports:
|
||||
# Allow dns resolution
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow access to kube-apiserver
|
||||
{{- range $port := .Values.apiserver.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
# RayCluster instances have the label ray.io/is-ray-node: "yes"
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
ray.io/is-ray-node: "yes"
|
||||
{{- if not .Values.apiserver.watchAllNamespaces }}
|
||||
{{- $watchNamespaces := default (list (include "common.names.namespace" .)) .Values.apiserver.watchNamespaces }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: namespace
|
||||
operator: In
|
||||
values:
|
||||
{{- range $namespace := $watchNamespaces }}
|
||||
- {{ $namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.apiserver.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.apiserver.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.apiserver.containerPorts.http }}
|
||||
- port: {{ .Values.apiserver.containerPorts.grpc }}
|
||||
{{- if not .Values.apiserver.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "kuberay.apiserver.fullname" . }}-client: "true"
|
||||
{{- if .Values.apiserver.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.apiserver.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.apiserver.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.apiserver.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.apiserver.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.apiserver.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
93
bitnami/kuberay/templates/operator/networkpolicy.yaml
Normal file
93
bitnami/kuberay/templates/operator/networkpolicy.yaml
Normal file
@@ -0,0 +1,93 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.operator.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "kuberay.operator.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: operator
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.operator.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
app.kubernetes.io/component: operator
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.operator.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
- ports:
|
||||
# Allow dns resolution
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow access to kube-operator
|
||||
{{- range $port := .Values.operator.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
# RayCluster instances have the label ray.io/is-ray-node: "yes"
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
ray.io/is-ray-node: "yes"
|
||||
{{- if not .Values.operator.watchAllNamespaces }}
|
||||
{{- $watchNamespaces := default (list (include "common.names.namespace" .)) .Values.operator.watchNamespaces }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: namespace
|
||||
operator: In
|
||||
values:
|
||||
{{- range $namespace := $watchNamespaces }}
|
||||
- {{ $namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.operator.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.operator.metrics.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.operator.containerPorts.metrics }}
|
||||
{{- if not .Values.operator.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/part-of: kuberay
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "kuberay.operator.fullname" . }}-client: "true"
|
||||
{{- if .Values.operator.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.operator.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.operator.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.operator.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -485,6 +485,65 @@ operator:
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param operator.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param operator.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param operator.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param operator.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param operator.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param operator.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param operator.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param operator.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
||||
##
|
||||
ingress:
|
||||
@@ -1077,6 +1136,65 @@ apiserver:
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param apiserver.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param apiserver.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param apiserver.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param apiserver.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param apiserver.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param apiserver.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param apiserver.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param apiserver.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
||||
##
|
||||
ingress:
|
||||
|
||||
Reference in New Issue
Block a user