DDBTEAM-570: Added network policies to chart

infrastructure/cover-service-faktor/templates/cron-job.yaml

@@ -15,6 +15,8 @@ spec:
         metadata:
           annotations:
             checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+          labels:
+            networking/allow-internet-access: "{{ .Release.Name }}"
         spec:
           containers:
             - name: cronjob

infrastructure/cover-service-faktor/templates/deployment.yaml

@@ -18,7 +18,9 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-app
-        tier: frontend
+        networking/allow-ingress-access: "true"
+        networking/allow-monitoring-access: "true"
+        networking/allow-internet-access: "{{ .Release.Name }}"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/path: "/metrics"
@@ -111,6 +113,7 @@ spec:
               name: {{ .Release.Name }}-nginx-config
         ports:
           - containerPort: 80
+            name: pod-http-port
       - name: nginx-exporter
         image: nginx/nginx-prometheus-exporter:{{ .Values.nginx.exporter.image.version }}
         imagePullPolicy: {{ .Values.app.image.imagePullPolicy }}

infrastructure/cover-service-faktor/templates/policy.yaml

@@ -0,0 +1,18 @@
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ .Release.Name }}-network-policy
+spec:
+  podSelector:
+    matchLabels:
+      networking/allow-internet-access: "{{ .Release.Name }}"
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+      ports:
+        # Need to communicate with open-platform and adgangsplatformen.
+        - protocol: TCP
+          port: 443

infrastructure/cover-service-faktor/templates/services.yaml

@@ -4,12 +4,9 @@ kind: Service
 metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-service
-  labels:
-    tier: frontend
 spec:
   selector:
     app: {{ .Release.Name }}-app
-    tier: frontend
   ports:
     - protocol: TCP
       port: 80