Allow to configure service network policy
The patch introduces network policy configuration similar to openstack-helm services. It allows users to configure policies depending on the environment. * Network policies are disabled by default. * When enabled default policies allow all ingress and egress traffic (i.e. policy set to {}), this may be changed in future patch-sets. Change-Id: Ie14a652830b4366e070ded91f8bbf83ca24d1007
This commit is contained in:
parent
4e76d15eda
commit
2d320ff0aa
18
charts/armada/templates/network_policy.yaml
Normal file
18
charts/armada/templates/network_policy.yaml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# Copyright 2017-2018 The Openstack-Helm Authors.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
{{- if .Values.manifests.network_policy -}}
|
||||||
|
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "armada" -}}
|
||||||
|
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
||||||
|
{{- end -}}
|
@ -337,6 +337,13 @@ pod:
|
|||||||
memory: "128Mi"
|
memory: "128Mi"
|
||||||
cpu: "100m"
|
cpu: "100m"
|
||||||
|
|
||||||
|
network_policy:
|
||||||
|
armada:
|
||||||
|
ingress:
|
||||||
|
- {}
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
|
||||||
manifests:
|
manifests:
|
||||||
configmap_bin: true
|
configmap_bin: true
|
||||||
configmap_etc: true
|
configmap_etc: true
|
||||||
@ -351,3 +358,4 @@ manifests:
|
|||||||
service: true
|
service: true
|
||||||
service_ingress: true
|
service_ingress: true
|
||||||
test_armada_api: true
|
test_armada_api: true
|
||||||
|
network_policy: false
|
||||||
|
18
charts/tiller/templates/network_policy.yaml
Normal file
18
charts/tiller/templates/network_policy.yaml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# Copyright 2017-2018 The Openstack-Helm Authors.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
{{- if .Values.manifests.network_policy -}}
|
||||||
|
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "tiller" -}}
|
||||||
|
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
||||||
|
{{- end -}}
|
@ -60,6 +60,14 @@ pod:
|
|||||||
memory: "128Mi"
|
memory: "128Mi"
|
||||||
cpu: "100m"
|
cpu: "100m"
|
||||||
|
|
||||||
|
network_policy:
|
||||||
|
tiller:
|
||||||
|
ingress:
|
||||||
|
- {}
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
|
||||||
manifests:
|
manifests:
|
||||||
deployment_tiller: true
|
deployment_tiller: true
|
||||||
service_tiller_deploy: true
|
service_tiller_deploy: true
|
||||||
|
network_policy: false
|
||||||
|
Loading…
Reference in New Issue
Block a user