Allow to configure service network policy

The patch introduces network policy configuration similar
to openstack-helm services. It allows users to configure
policies depending on the environment.

* Network policies are disabled by default.
* When enabled default policies allow all ingress and
  egress traffic (i.e. policy set to {}), this may be
  changed in future patch-sets.

Change-Id: Ie14a652830b4366e070ded91f8bbf83ca24d1007
This commit is contained in:
Evgeny L 2019-09-20 19:41:50 +00:00
parent 4e76d15eda
commit 2d320ff0aa
4 changed files with 52 additions and 0 deletions

View File

@ -0,0 +1,18 @@
# Copyright 2017-2018 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
{{- if .Values.manifests.network_policy -}}
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "armada" -}}
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
{{- end -}}

View File

@ -337,6 +337,13 @@ pod:
memory: "128Mi"
cpu: "100m"
network_policy:
armada:
ingress:
- {}
egress:
- {}
manifests:
configmap_bin: true
configmap_etc: true
@ -351,3 +358,4 @@ manifests:
service: true
service_ingress: true
test_armada_api: true
network_policy: false

View File

@ -0,0 +1,18 @@
# Copyright 2017-2018 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
{{- if .Values.manifests.network_policy -}}
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "tiller" -}}
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
{{- end -}}

View File

@ -60,6 +60,14 @@ pod:
memory: "128Mi"
cpu: "100m"
network_policy:
tiller:
ingress:
- {}
egress:
- {}
manifests:
deployment_tiller: true
service_tiller_deploy: true
network_policy: false