mirror of
https://github.com/bitnami/charts.git
synced 2026-03-16 06:47:30 +08:00
[bitnami/minio] feat: ✨ 🔒 Add network policy to provisioning job (#24512)
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
committed by
GitHub
GitHub
parent
b156f2efb3
commit
fba34b2ae5
@@ -34,4 +34,4 @@ maintainers:
|
||||
name: minio
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/minio
|
||||
version: 14.0.0
|
||||
version: 14.1.0
|
||||
|
||||
@@ -311,6 +311,10 @@ You can enable this initContainer by setting `volumePermissions.enabled` to `tru
|
||||
| `provisioning.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `provisioning.cleanupAfterFinished.enabled` | Enables Cleanup for Finished Jobs | `false` |
|
||||
| `provisioning.cleanupAfterFinished.seconds` | Sets the value of ttlSecondsAfterFinished | `600` |
|
||||
| `provisioning.networkPolicy.enabled` | Enable creation of NetworkPolicy resources | `true` |
|
||||
| `provisioning.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `provisioning.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `provisioning.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `automountServiceAccountToken` | Mount Service Account token in pod | `false` |
|
||||
| `hostAliases` | MinIO® pod host aliases | `[]` |
|
||||
| `containerPorts.api` | MinIO® container port to open for MinIO® API | `9000` |
|
||||
|
||||
50
bitnami/minio/templates/provisioning-networkpolicy.yaml
Normal file
50
bitnami/minio/templates/provisioning-networkpolicy.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.provisioning.enabled .Values.provisioning.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-provisioning" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: minio-provisioning
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.provisioning.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
# Allow outbound connections to other cluster pods
|
||||
- ports:
|
||||
- port: {{ .Values.containerPorts.api }}
|
||||
- port: {{ .Values.containerPorts.console }}
|
||||
- port: {{ .Values.service.ports.api }}
|
||||
- port: {{ .Values.service.ports.console }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.provisioning.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dataCoord.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.provisioning.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.initJob.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -448,6 +448,50 @@ provisioning:
|
||||
cleanupAfterFinished:
|
||||
enabled: false
|
||||
seconds: 600
|
||||
## Network Policy configuration
|
||||
## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param provisioning.networkPolicy.enabled Enable creation of NetworkPolicy resources
|
||||
##
|
||||
enabled: true
|
||||
## @param provisioning.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param provisioning.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraIngress: []
|
||||
## @param provisioning.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
|
||||
Reference in New Issue
Block a user