From e4346af5baed9c21f95082ad2cecd47c9f31e37d Mon Sep 17 00:00:00 2001 From: Karan Parashar Date: Wed, 28 Oct 2026 15:27:26 +0530 Subject: [PATCH] chore(add-ons): Add network policies to operators and monitoring --- add-ons/cnpg/kustomization.yaml | 4 ++ add-ons/cnpg/networkpolicy.yaml | 41 ++++++++++++++ argocd-apps/add-ons/alloy.yaml | 27 +++++++++ argocd-apps/add-ons/cert-manager.yaml | 18 ++++++ argocd-apps/add-ons/cnpg.yaml | 35 ++++++------ .../add-ons/kube-prometheus-stack.yaml | 56 +++++++++++++++++++ argocd-apps/add-ons/loki.yaml | 9 +++ argocd-apps/add-ons/sealed-secrets.yaml | 7 +++ 8 files changed, 181 insertions(+), 16 deletions(-) create mode 100644 add-ons/cnpg/kustomization.yaml create mode 100644 add-ons/cnpg/networkpolicy.yaml diff --git a/add-ons/cnpg/kustomization.yaml b/add-ons/cnpg/kustomization.yaml new file mode 100644 index 0000000..b90ff79 --- /dev/null +++ b/add-ons/cnpg/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - networkpolicy.yaml diff --git a/add-ons/cnpg/networkpolicy.yaml b/add-ons/cnpg/networkpolicy.yaml new file mode 100644 index 0000000..0b066bc --- /dev/null +++ b/add-ons/cnpg/networkpolicy.yaml @@ -0,0 +1,41 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: cnpg + namespace: cnpg-system +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 6443 + protocol: TCP + - ports: + - port: 8000 + protocol: TCP + to: + - namespaceSelector: {} + podSelector: + matchExpressions: + - key: cnpg.io/cluster + operator: Exists + ingress: + - ports: + - port: 9443 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: cloudnative-pg + policyTypes: + - Ingress + - Egress diff --git a/argocd-apps/add-ons/alloy.yaml b/argocd-apps/add-ons/alloy.yaml index 9804c40..5638b5b 100644 --- a/argocd-apps/add-ons/alloy.yaml +++ b/argocd-apps/add-ons/alloy.yaml @@ -15,6 +15,33 @@ spec: chart: alloy helm: values: | + # Discovers pods through the API and pushes their logs to Loki + networkPolicy: + enabled: true + ingress: [] + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 6443 + protocol: TCP + - ports: + - port: 3100 + protocol: TCP + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: loki alloy: configMap: content: | diff --git a/argocd-apps/add-ons/cert-manager.yaml b/argocd-apps/add-ons/cert-manager.yaml index 1294656..5001c15 100644 --- a/argocd-apps/add-ons/cert-manager.yaml +++ b/argocd-apps/add-ons/cert-manager.yaml @@ -29,7 +29,18 @@ spec: requests: cpu: 10m memory: 64Mi + # The chart's egress fits the controller: ACME and Cloudflare on 443, + # DNS-01 propagation checks on 53, and the API on 6443 + networkPolicy: + enabled: true cainjector: + # Only talks to the API + networkPolicy: + enabled: true + egress: + - ports: + - port: 6443 + protocol: TCP resources: limits: cpu: 200m @@ -38,6 +49,13 @@ spec: cpu: 10m memory: 64Mi webhook: + # Only talks to the API + networkPolicy: + enabled: true + egress: + - ports: + - port: 6443 + protocol: TCP resources: limits: cpu: 200m diff --git a/argocd-apps/add-ons/cnpg.yaml b/argocd-apps/add-ons/cnpg.yaml index 7aae79b..fae8b5c 100644 --- a/argocd-apps/add-ons/cnpg.yaml +++ b/argocd-apps/add-ons/cnpg.yaml @@ -11,22 +11,25 @@ spec: namespace: cnpg-system server: https://kubernetes.default.svc project: default - source: - chart: cloudnative-pg - helm: - values: | - replicaCount: 1 - config: - clusterWide: true - resources: - limits: - cpu: 500m - memory: 256Mi - requests: - cpu: 10m - memory: 64Mi - repoURL: https://cloudnative-pg.github.io/charts - targetRevision: 0.29.1 + sources: + - chart: cloudnative-pg + helm: + values: | + replicaCount: 1 + config: + clusterWide: true + resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + repoURL: https://cloudnative-pg.github.io/charts + targetRevision: 0.29.1 + - path: add-ons/cnpg + repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git + targetRevision: main syncPolicy: automated: prune: true diff --git a/argocd-apps/add-ons/kube-prometheus-stack.yaml b/argocd-apps/add-ons/kube-prometheus-stack.yaml index 89e0c2b..fe4ef6f 100644 --- a/argocd-apps/add-ons/kube-prometheus-stack.yaml +++ b/argocd-apps/add-ons/kube-prometheus-stack.yaml @@ -47,6 +47,9 @@ spec: kubeStateMetrics: enabled: false prometheusOperator: + # The chart's policy only limits ingress to the webhook; egress stays open + networkPolicy: + enabled: true admissionWebhooks: certManager: enabled: true @@ -96,6 +99,38 @@ spec: cpu: 20m memory: 32Mi prometheus: + # Only Grafana queries it; it scrapes the kubelet and node-exporter on the + # node, matched by port so no node IP is needed + networkPolicy: + enabled: true + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: grafana + ports: + - port: 9090 + protocol: TCP + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 6443 + protocol: TCP + - port: 9100 + protocol: TCP + - port: 10250 + protocol: TCP serviceMonitor: selfMonitor: false prometheusSpec: @@ -124,6 +159,27 @@ spec: requests: storage: 50Gi grafana: + # The chart takes one list of egress ports for every destination: OIDC + # on 443, Loki, Postgres, the API for the sidecars, and Prometheus + networkPolicy: + enabled: true + allowExternal: false + explicitNamespacesSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + egress: + enabled: true + ports: + - port: 443 + protocol: TCP + - port: 3100 + protocol: TCP + - port: 5432 + protocol: TCP + - port: 6443 + protocol: TCP + - port: 9090 + protocol: TCP admin: existingSecret: grafana-admin additionalDataSources: diff --git a/argocd-apps/add-ons/loki.yaml b/argocd-apps/add-ons/loki.yaml index 33569f4..5e07f74 100644 --- a/argocd-apps/add-ons/loki.yaml +++ b/argocd-apps/add-ons/loki.yaml @@ -15,6 +15,15 @@ spec: - chart: loki helm: values: | + # Garage on 3900; the rules sidecar watches the API, which only the + # discovery port can allow + networkPolicy: + enabled: true + externalStorage: + ports: + - 3900 + discovery: + port: 6443 loki: auth_enabled: false commonConfig: diff --git a/argocd-apps/add-ons/sealed-secrets.yaml b/argocd-apps/add-ons/sealed-secrets.yaml index 126b767..1f9182a 100644 --- a/argocd-apps/add-ons/sealed-secrets.yaml +++ b/argocd-apps/add-ons/sealed-secrets.yaml @@ -16,6 +16,13 @@ spec: helm: values: | keyrenewperiod: "0" + # The API is reached by port alone, so the policy doesn't depend on the node's IP + networkPolicy: + enabled: true + egress: + enabled: true + kubeapiCidr: 0.0.0.0/0 + kubeapiPort: 6443 resources: limits: cpu: 200m