Merge pull request #1 from caas-team/feat/network-policies

Add network policies for monitoring components

.pre-commit-config.yaml

@@ -0,0 +1,7 @@
+repos:
+  - repo: https://github.com/norwoodj/helm-docs
+    rev: "v1.11.3"
+    hooks:
+      - id: helm-docs
+        args:
+          - --chart-search-root=./

README.md

@@ -44,11 +44,13 @@ available config parameters:
 
 | Parameter | Type | Default | Description |
 |-----------|------|---------|-------------|
+| `caas.clusterCosts` | bool | `true` | whether the cluster has kubecost installed |
+| `caas.dynatrace` | bool | `true` | whether the cluster has a dynatrace operator installed |
 | `caas.fullnameOverride` | string | `""` |  |
 | `caas.grafana.configmaps` | bool | `false` |  |
 | `caas.nameOverride` | string | `""` |  |
-| `caas.namespaceOverride` | string | `""` |  |
-| `caas.rbac.enabled` | bool | `true` |  |
+| `caas.namespaceOverride` | string | `""` | overrides the default namespace for caas related resources |
+| `caas.rbac.enabled` | bool | `true` | create a namespaces ServiceAccount |
 | `caas.rbac.serviceAccount.create` | bool | `true` |  |
 | `caas.rbac.serviceAccount.name` | string | `"rancher-monitoring"` |  |
 
@@ -284,6 +286,8 @@ available config parameters:
 | `kube-prometheus-stack.prometheus-node-exporter.prometheus.monitor.enabled` | bool | `true` |  |
 | `kube-prometheus-stack.prometheus-node-exporter.rbac.pspEnabled` | bool | `false` |  |
 | `kube-prometheus-stack.prometheus-node-exporter.releaseLabel` | bool | `true` |  |
+| `kube-prometheus-stack.prometheus-node-exporter.service.port` | int | `9796` |  |
+| `kube-prometheus-stack.prometheus-node-exporter.service.targetPort` | int | `9796` |  |
 | `kube-prometheus-stack.prometheus.additionalRulesForClusterRole[0].apiGroups[0]` | string | `""` |  |
 | `kube-prometheus-stack.prometheus.additionalRulesForClusterRole[0].resources[0]` | string | `"configmaps"` |  |
 | `kube-prometheus-stack.prometheus.additionalRulesForClusterRole[0].resources[1]` | string | `"namespaces"` |  |

templates/np-dynakube.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.caas.dynatrace }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-from-dynatrace
+  namespace: cattle-monitoring-system
+spec:
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          field.cattle.io/projectId: dynatrace
+  podSelector:
+    matchLabels:
+      release: rancher-monitoring
+  policyTypes:
+  - Ingress
+{{- end }}

templates/np-kubecost.yaml

@@ -0,0 +1,19 @@
+
+{{- if .Values.caas.clusterCosts }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+    name: allow-ingress-from-cluster-costs
+    namespace: cattle-monitoring-system
+spec:
+    ingress:
+    - from:
+        - namespaceSelector:
+                matchLabels:
+                    field.cattle.io/projectId: cluster-costs
+    podSelector:
+        matchLabels:
+            app.kubernetes.io/name: kube-state-metrics
+    policyTypes:
+    - Ingress
+{{- end }}

templates/np-prometheus-auth.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-prometheus-auth
+  namespace: cattle-monitoring-system
+spec:
+  ingress:
+  - ports:
+    - port: 9091
+      protocol: TCP
+  podSelector: {}
+  policyTypes:
+  - Ingress
+status: {}

templates/np-quality-dashboard.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-grafana-to-prometheus
+  namespace: cattle-monitoring-system
+spec:
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: caas-quality-dashboard
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus
+  policyTypes:
+  - Ingress
+status: {}