Skip to content

Commit e86ef65

Browse files
CasLubberssvcAPLBototomi-admin
authored
feat: add network policies chart (#2434)
Co-authored-by: svcAPLBot <[email protected]> Co-authored-by: otomi-admin <[email protected]>
1 parent 5d3d76e commit e86ef65

File tree

8 files changed

+195
-0
lines changed

8 files changed

+195
-0
lines changed

‎charts/apl-network-policies/Chart.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v2
2+
name: apl-network-policies
3+
description: APL Platform Network Policies for secure application communication
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0"
7+
keywords:
8+
- network-policy
9+
- security
10+
- platform
11+
home: https://github.com/linode/apl-core
12+
maintainers:
13+
- name: APL Team
14+
url: https://github.com/linode/apl-core

‎charts/apl-network-policies/templates/_helpers.tpl

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "apl-network-policies.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "apl-network-policies.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "apl-network-policies.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "apl-network-policies.labels" -}}
37+
helm.sh/chart: {{ include "apl-network-policies.chart" . }}
38+
{{ include "apl-network-policies.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "apl-network-policies.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "apl-network-policies.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}

‎charts/apl-network-policies/templates/networkpolicies/gitea.yaml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{{- if .Values.netpols.gitea }}
2+
---
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: gitea-platform-policy
7+
namespace: gitea
8+
labels:
9+
{{- include "apl-network-policies.labels" . | nindent 4 }}
10+
app: gitea
11+
spec:
12+
podSelector: {}
13+
policyTypes:
14+
- Ingress
15+
ingress:
16+
# Allow access from Istio public ingress gateway
17+
- from:
18+
- namespaceSelector:
19+
matchLabels:
20+
name: istio-system
21+
podSelector:
22+
matchLabels:
23+
app.kubernetes.io/instance: istio-ingressgateway-public
24+
# Allow APL Gitea operator access
25+
- from:
26+
- namespaceSelector:
27+
matchLabels:
28+
name: apl-gitea-operator
29+
# Allow APL operator access
30+
- from:
31+
- namespaceSelector:
32+
matchLabels:
33+
name: apl-operator
34+
# Allow APL API access
35+
- from:
36+
- namespaceSelector:
37+
matchLabels:
38+
name: otomi
39+
podSelector:
40+
matchLabels:
41+
app.kubernetes.io/name: otomi-api
42+
# Allow team build access for git clone
43+
- from:
44+
- namespaceSelector:
45+
matchLabels:
46+
type: team
47+
podSelector:
48+
matchLabels:
49+
tekton.dev/task: git-clone
50+
# Allow monitoring access
51+
- from:
52+
- namespaceSelector:
53+
matchLabels:
54+
name: monitoring
55+
podSelector:
56+
matchLabels:
57+
app.kubernetes.io/instance: po-prometheus
58+
# Allow CNPG system access
59+
- from:
60+
- namespaceSelector:
61+
matchLabels:
62+
name: cnpg-system
63+
# Allow database access within gitea namespace
64+
- from:
65+
- namespaceSelector:
66+
matchLabels:
67+
name: gitea
68+
podSelector:
69+
matchLabels:
70+
cnpg.io/cluster: gitea-db
71+
# Allow internal gitea app communication
72+
- from:
73+
- namespaceSelector:
74+
matchLabels:
75+
name: gitea
76+
podSelector:
77+
matchLabels:
78+
app: gitea
79+
{{- end }}

‎charts/apl-network-policies/values.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Default configuration for APL Network Policies
2+
# Network policies are now configured using simple per-app boolean flags
3+
4+
# The actual network policies configuration comes from defaults.yaml
5+
# This values.yaml file contains only examples for reference
6+
7+
# Example configuration (all commented out):
8+
# Simple on/off switch per application
9+
# netpols:
10+
# gitea: true # Enable network policies for Gitea with sensible defaults
11+
12+
# Network policy behavior when enabled:
13+
#
14+
# For Gitea (netpols.gitea: true):
15+
# - Creates a NetworkPolicy in the gitea namespace
16+
# - Allows ingress from:
17+
# * Istio public ingress gateway (for web access)
18+
# * APL Gitea operator (for management)
19+
# * APL operator (for core management)
20+
# * APL API (for API access)
21+
# * Team namespaces with git-clone tasks (for CI/CD)
22+
# * Monitoring namespace (for metrics)
23+
# * CNPG system (for database management)
24+
# * Internal gitea namespace communication
25+
#
26+
# The complex network policy rules are baked into the chart templates,
27+
# so users only need to toggle network policies on/off per application.

‎helmfile.d/helmfile-07.init.yaml.gotmpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,10 @@ releases:
3838
labels:
3939
pkg: minio
4040
<<: *raw
41+
- name: apl-network-policies
42+
installed: true
43+
namespace: apl-operator
44+
labels:
45+
pkg: platform
46+
<<: *default
47+

‎helmfile.d/snippets/defaults.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,8 @@ environments:
305305
gitea:
306306
adminUsername: otomi-admin
307307
_rawValues: {}
308+
networkPolicies:
309+
enabled: true
308310
resources:
309311
gitea:
310312
limits:

‎values-schema.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,13 @@ definitions:
604604
nullable: true
605605
type: object
606606
title: Kubernetes secrets
607+
appNetworkPolicyConfig:
608+
type: object
609+
properties:
610+
enabled:
611+
type: boolean
612+
default: false
613+
description: Enable network policies for this application with sensible defaults
607614
netpol:
608615
type: object
609616
properties:
@@ -1893,6 +1900,8 @@ properties:
18931900
$ref: '#/definitions/resources'
18941901
memcachedMetrics:
18951902
$ref: '#/definitions/resources'
1903+
networkPolicies:
1904+
$ref: '#/definitions/appNetworkPolicyConfig'
18961905
grafana:
18971906
additionalProperties: false
18981907
properties:

‎values/apl-network-policies/apl-network-policies.gotmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{{- $v := .Values }}
2+
{{- $a := $v.apps }}
3+
4+
# Simple per-app network policy configuration
5+
netpols:
6+
gitea: {{ $a.gitea.networkPolicies.enabled}}

0 commit comments

Comments
 (0)