chore(add-ons): Add network policies to operators and monitoring
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- networkpolicy.yaml
|
||||
@@ -0,0 +1,41 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: cnpg
|
||||
namespace: cnpg-system
|
||||
spec:
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
- ports:
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
- ports:
|
||||
- port: 8000
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector: {}
|
||||
podSelector:
|
||||
matchExpressions:
|
||||
- key: cnpg.io/cluster
|
||||
operator: Exists
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 9443
|
||||
protocol: TCP
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: cloudnative-pg
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
@@ -15,6 +15,33 @@ spec:
|
||||
chart: alloy
|
||||
helm:
|
||||
values: |
|
||||
# Discovers pods through the API and pushes their logs to Loki
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
ingress: []
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
- ports:
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
- ports:
|
||||
- port: 3100
|
||||
protocol: TCP
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: loki
|
||||
alloy:
|
||||
configMap:
|
||||
content: |
|
||||
|
||||
@@ -29,7 +29,18 @@ spec:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
# The chart's egress fits the controller: ACME and Cloudflare on 443,
|
||||
# DNS-01 propagation checks on 53, and the API on 6443
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
cainjector:
|
||||
# Only talks to the API
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
egress:
|
||||
- ports:
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
@@ -38,6 +49,13 @@ spec:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
webhook:
|
||||
# Only talks to the API
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
egress:
|
||||
- ports:
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
|
||||
@@ -11,8 +11,8 @@ spec:
|
||||
namespace: cnpg-system
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
chart: cloudnative-pg
|
||||
sources:
|
||||
- chart: cloudnative-pg
|
||||
helm:
|
||||
values: |
|
||||
replicaCount: 1
|
||||
@@ -27,6 +27,9 @@ spec:
|
||||
memory: 64Mi
|
||||
repoURL: https://cloudnative-pg.github.io/charts
|
||||
targetRevision: 0.29.1
|
||||
- path: add-ons/cnpg
|
||||
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
|
||||
targetRevision: main
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
|
||||
@@ -47,6 +47,9 @@ spec:
|
||||
kubeStateMetrics:
|
||||
enabled: false
|
||||
prometheusOperator:
|
||||
# The chart's policy only limits ingress to the webhook; egress stays open
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
admissionWebhooks:
|
||||
certManager:
|
||||
enabled: true
|
||||
@@ -96,6 +99,38 @@ spec:
|
||||
cpu: 20m
|
||||
memory: 32Mi
|
||||
prometheus:
|
||||
# Only Grafana queries it; it scrapes the kubelet and node-exporter on the
|
||||
# node, matched by port so no node IP is needed
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
ports:
|
||||
- port: 9090
|
||||
protocol: TCP
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
- ports:
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
- port: 9100
|
||||
protocol: TCP
|
||||
- port: 10250
|
||||
protocol: TCP
|
||||
serviceMonitor:
|
||||
selfMonitor: false
|
||||
prometheusSpec:
|
||||
@@ -124,6 +159,27 @@ spec:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
grafana:
|
||||
# The chart takes one list of egress ports for every destination: OIDC
|
||||
# on 443, Loki, Postgres, the API for the sidecars, and Prometheus
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
allowExternal: false
|
||||
explicitNamespacesSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: traefik
|
||||
egress:
|
||||
enabled: true
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
- port: 3100
|
||||
protocol: TCP
|
||||
- port: 5432
|
||||
protocol: TCP
|
||||
- port: 6443
|
||||
protocol: TCP
|
||||
- port: 9090
|
||||
protocol: TCP
|
||||
admin:
|
||||
existingSecret: grafana-admin
|
||||
additionalDataSources:
|
||||
|
||||
@@ -15,6 +15,15 @@ spec:
|
||||
- chart: loki
|
||||
helm:
|
||||
values: |
|
||||
# Garage on 3900; the rules sidecar watches the API, which only the
|
||||
# discovery port can allow
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
externalStorage:
|
||||
ports:
|
||||
- 3900
|
||||
discovery:
|
||||
port: 6443
|
||||
loki:
|
||||
auth_enabled: false
|
||||
commonConfig:
|
||||
|
||||
@@ -16,6 +16,13 @@ spec:
|
||||
helm:
|
||||
values: |
|
||||
keyrenewperiod: "0"
|
||||
# The API is reached by port alone, so the policy doesn't depend on the node's IP
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
egress:
|
||||
enabled: true
|
||||
kubeapiCidr: 0.0.0.0/0
|
||||
kubeapiPort: 6443
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
|
||||
Reference in New Issue
Block a user