fix: Network policies for pgsql clusters (#29)

homecentr · Nov 10, 2023 · 559d3d0 · 559d3d0
1 parent eb4f0cd
commit 559d3d0
Show file tree

Hide file tree

Showing 8 changed files with 87 additions and 86 deletions.
diff --git a/apps/common/templates/_labels.tpl b/apps/common/templates/_labels.tpl
@@ -7,6 +7,6 @@ helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
 {{- end }}
 
 {{- define "common.pod-labels" }}
-app.kubernetes.io/name: {{ $.Chart.Name }}
-app.kubernetes.io/instance: {{ $.Release.Name }}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
diff --git a/apps/common/templates/_network-policies-postgresql.tpl b/apps/common/templates/_network-policies-postgresql.tpl
@@ -0,0 +1,80 @@
+{{- define "common.network-policy-postgresql-cluster" }}
+{{- $appPodSelector := .AppPodSelector }}
+{{- with .Root }}
+{{- $clusterName := .Release.Name }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ $clusterName }}-postgresql-cluster
+  labels:
+    {{- include "common.resource-labels" . | indent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/podRole: instance
+      cnpg.io/cluster: {{ $clusterName }}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    # Allow cluster instances to talk to Kube API
+    {{- include "common.egress-kubeapi" . | indent 4 }}
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 5432
+      from:
+        # Accept traffic from postgresql jobs related to the same cluster
+        - podSelector:
+            matchExpressions:
+              - key: cnpg.io/jobRole
+                operator: Exists
+              - key: cnpg.io/cluster
+                operator: In
+                values:
+                  - {{ $clusterName }}
+        # Accept traffic from other cluster instances
+        - podSelector:
+            matchLabels:
+              cnpg.io/podRole: instance
+              cnpg.io/cluster: {{ $clusterName }}
+
+        {{- if $appPodSelector }}
+        # Accept traffic from consuming app
+        - podSelector: {{ $appPodSelector | toYaml | nindent 12 }}
+        {{- end }}
+
+    # Accept traffic from operator in postgresql-system namespace
+    - ports:
+        - protocol: TCP
+          port: 8000
+      from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgresql-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: cloudnative-pg
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ $clusterName }}-postgresql-jobs
+  labels:
+    {{- include "common.resource-labels" . | indent 4 }}
+spec:
+  podSelector:
+    matchExpressions:
+      - key: cnpg.io/jobRole
+        operator: Exists
+      - key: cnpg.io/cluster
+        operator: In
+        values:
+          - {{ $clusterName }}
+  policyTypes:
+    - Egress
+  egress:
+    # Allow jobs to talk to Kube API
+    {{- include "common.egress-kubeapi" . | indent 4 }}
+{{- end }}
+{{- end }}
diff --git a/apps/cyberchef/templates/deployment.yml b/apps/cyberchef/templates/deployment.yml
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ .Release.Name }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.resource-labels" . | indent 4 }}
 spec:

diff --git a/apps/cyberchef/templates/network-policy.yml b/apps/cyberchef/templates/network-policy.yml
@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ .Release.Name }}
-  namespace: {{ $.Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "common.resource-labels" . | indent 4 }}
 spec:

diff --git a/apps/network-policies/templates/network-policy-postgresql-clusters.yml b/apps/network-policies/templates/network-policy-postgresql-clusters.yml
diff --git a/apps/network-policies/templates/network-policy-postgresql-jobs.yml b/apps/network-policies/templates/network-policy-postgresql-jobs.yml
diff --git a/apps/pomerium/templates/custom-network-policy-postgresql-cluster.yml b/apps/pomerium/templates/custom-network-policy-postgresql-cluster.yml
@@ -1,27 +1,2 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: {{ .Release.Name }}-postgresql
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    {{- include "common.resource-labels" . | indent 4 }}
-spec:
-  podSelector:
-    matchExpressions:
-      - key: cnpg.io/cluster
-        operator: In
-        values: 
-          - {{ $.Release.Name }}
-  policyTypes:
-    - Ingress
-  ingress:
-    # Accept traffic from pomerium
-    - ports:
-        - protocol: TCP
-          port: 5432
-      from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: pomerium
-              app.kubernetes.io/instance: {{ .Release.Name }}
-
+{{- $appPodSelector := (dict "matchLabels" (include "common.pod-labels" . | fromYaml)) }}
+{{ include "common.network-policy-postgresql-cluster" (dict "Root" . "AppPodSelector" $appPodSelector) }}
diff --git a/apps/pomerium/values.lab.yml b/apps/pomerium/values.lab.yml
@@ -18,4 +18,4 @@ postgresql:
   size: 10Gi
   storageClass: local-path-provisioner-services-db
   accessModes:
-    - ReadWriteMany
+    - ReadWriteMany