Skip to content

Commit 6c4074e

Browse files
cbalancbalan
committed
feat: Add support for ingress network policies at vcluster creation time
1 parent 82a8c36 commit 6c4074e

File tree

6 files changed

+306
-1
lines changed

6 files changed

+306
-1
lines changed

‎chart/templates/networkpolicy.yaml‎

Lines changed: 176 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,4 +105,179 @@ spec:
105105
{{- end }}
106106
policyTypes:
107107
- Egress
108-
{{- end }}
108+
{{- end }}
109+
{{- if .Values.policies.networkPolicy.ingress.enabled }}
110+
---
111+
apiVersion: networking.k8s.io/v1
112+
kind: NetworkPolicy
113+
metadata:
114+
name: vc-cp-{{ .Release.Name }}-ingress
115+
namespace: {{ .Release.Namespace }}
116+
labels:
117+
app: vcluster
118+
chart: "{{ include "vcluster.version.label" $ }}"
119+
release: "{{ .Release.Name }}"
120+
heritage: "{{ .Release.Service }}"
121+
{{- if .Values.policies.networkPolicy.labels }}
122+
{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }}
123+
{{- end }}
124+
{{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }}
125+
{{- if $annotations }}
126+
annotations:
127+
{{ toYaml $annotations | indent 4 }}
128+
{{- end }}
129+
spec:
130+
podSelector:
131+
matchLabels:
132+
release: {{ .Release.Name }}
133+
policyTypes:
134+
- Ingress
135+
ingress:
136+
- ports:
137+
- port: 8443
138+
protocol: TCP
139+
from:
140+
# Allow for vcluster workloads traffic
141+
- podSelector:
142+
matchLabels:
143+
vcluster.loft.sh/managed-by: {{ .Release.Name }}
144+
{{- if .Values.policies.networkPolicy.ingress.platform }}
145+
# Allow ingress access from the loft platform.
146+
- podSelector:
147+
matchLabels:
148+
app: loft
149+
namespaceSelector: {}
150+
{{- end }}
151+
152+
{{- if .Values.policies.networkPolicy.ingress.controlPlaneRules }}
153+
{{ toYaml .Values.policies.networkPolicy.ingress.controlPlaneRules | indent 4 }}
154+
{{- end }}
155+
---
156+
apiVersion: networking.k8s.io/v1
157+
kind: NetworkPolicy
158+
metadata:
159+
name: vc-kube-dns-{{ .Release.Name }}-ingress
160+
namespace: {{ .Release.Namespace }}
161+
labels:
162+
app: vcluster
163+
chart: "{{ include "vcluster.version.label" $ }}"
164+
release: "{{ .Release.Name }}"
165+
heritage: "{{ .Release.Service }}"
166+
{{- if .Values.policies.networkPolicy.labels }}
167+
{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }}
168+
{{- end }}
169+
{{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }}
170+
{{- if $annotations }}
171+
annotations:
172+
{{ toYaml $annotations | indent 4 }}
173+
{{- end }}
174+
spec:
175+
podSelector:
176+
matchLabels:
177+
k8s-app: vcluster-kube-dns
178+
vcluster.loft.sh/managed-by: {{ .Release.Name }}
179+
policyTypes:
180+
- Ingress
181+
ingress:
182+
# Allows incoming connections to DNS server
183+
- ports:
184+
- port: 1053
185+
protocol: TCP
186+
- port: 1053
187+
protocol: UDP
188+
from:
189+
- podSelector:
190+
matchLabels:
191+
vcluster.loft.sh/managed-by: {{ .Release.Name }}
192+
193+
{{- if .Values.policies.networkPolicy.ingress.kubeDnsRules }}
194+
{{ toYaml .Values.policies.networkPolicy.ingress.kubeDnsRules | indent 4 }}
195+
{{- end }}
196+
---
197+
apiVersion: networking.k8s.io/v1
198+
kind: NetworkPolicy
199+
metadata:
200+
name: vc-work-{{ .Release.Name }}-ingress
201+
namespace: {{ .Release.Namespace }}
202+
labels:
203+
app: vcluster
204+
chart: "{{ include "vcluster.version.label" $ }}"
205+
release: "{{ .Release.Name }}"
206+
heritage: "{{ .Release.Service }}"
207+
{{- if .Values.policies.networkPolicy.labels }}
208+
{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }}
209+
{{- end }}
210+
{{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }}
211+
{{- if $annotations }}
212+
annotations:
213+
{{ toYaml $annotations | indent 4 }}
214+
{{- end }}
215+
spec:
216+
podSelector:
217+
matchLabels:
218+
vcluster.loft.sh/managed-by: {{ .Release.Name }}
219+
policyTypes:
220+
- Ingress
221+
ingress:
222+
- from:
223+
# Allow incoming connections from other vcluster workloads
224+
- podSelector:
225+
matchLabels:
226+
vcluster.loft.sh/managed-by: {{ .Release.Name }}
227+
{{- if .Values.policies.networkPolicy.ingress.workloadRules }}
228+
{{ toYaml .Values.policies.networkPolicy.ingress.workloadRules | indent 4 }}
229+
{{- end }}
230+
{{- if and .Values.controlPlane.backingStore.etcd.deploy.enabled .Values.controlPlane.backingStore.etcd.deploy.statefulSet.enabled }}
231+
---
232+
apiVersion: networking.k8s.io/v1
233+
kind: NetworkPolicy
234+
metadata:
235+
name: vc-etcd-{{ .Release.Name }}-ingress
236+
namespace: {{ .Release.Namespace }}
237+
labels:
238+
app: vcluster
239+
chart: "{{ include "vcluster.version.label" $ }}"
240+
release: "{{ .Release.Name }}"
241+
heritage: "{{ .Release.Service }}"
242+
{{- if .Values.policies.networkPolicy.labels }}
243+
{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }}
244+
{{- end }}
245+
{{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }}
246+
{{- if $annotations }}
247+
annotations:
248+
{{ toYaml $annotations | indent 4 }}
249+
{{- end }}
250+
spec:
251+
podSelector:
252+
matchLabels:
253+
app: vcluster-etcd
254+
release: {{ .Release.Name }}
255+
policyTypes:
256+
- Ingress
257+
ingress:
258+
- ports:
259+
- port: 2380
260+
protocol: TCP
261+
from:
262+
# Allow for vc-etcd peer traffic
263+
- podSelector:
264+
matchLabels:
265+
app: vcluster-etcd
266+
release: {{ .Release.Name }}
267+
- ports:
268+
- port: 2379
269+
protocol: TCP
270+
from:
271+
# Allow for vc-cp traffic
272+
- podSelector:
273+
matchLabels:
274+
app: vcluster
275+
release: {{ .Release.Name }}
276+
277+
# Allow for vc-etcd peer traffic
278+
- podSelector:
279+
matchLabels:
280+
app: vcluster-etcd
281+
release: {{ .Release.Name }}
282+
{{- end }}
283+
{{- end }}

‎chart/tests/networkpolicy_test.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,3 +121,56 @@ tests:
121121
equal:
122122
path: spec.egress[3].ports[2].port
123123
value: 6443
124+
125+
- it: check ingress defaults
126+
release:
127+
name: my-release
128+
namespace: my-namespace
129+
set:
130+
policies:
131+
networkPolicy:
132+
ingress:
133+
enabled: true
134+
asserts:
135+
- hasDocuments:
136+
count: 3
137+
- documentIndex: 0
138+
equal:
139+
path: metadata.name
140+
value: vc-cp-my-release-ingress
141+
- documentIndex: 0
142+
equal:
143+
path: spec.policyTypes
144+
value: ["Ingress"]
145+
- documentIndex: 0
146+
lengthEqual:
147+
path: spec.ingress
148+
count: 1
149+
- documentIndex: 0
150+
lengthEqual:
151+
path: spec.ingress[0].from
152+
count: 2
153+
- documentIndex: 1
154+
equal:
155+
path: metadata.name
156+
value: vc-kube-dns-my-release-ingress
157+
- documentIndex: 1
158+
equal:
159+
path: spec.policyTypes
160+
value: ["Ingress"]
161+
- documentIndex: 1
162+
lengthEqual:
163+
path: spec.ingress
164+
count: 1
165+
- documentIndex: 2
166+
equal:
167+
path: metadata.name
168+
value: vc-work-my-release-ingress
169+
- documentIndex: 2
170+
equal:
171+
path: spec.policyTypes
172+
value: ["Ingress"]
173+
- documentIndex: 2
174+
lengthEqual:
175+
path: spec.ingress
176+
count: 1

‎chart/values.schema.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2930,6 +2930,10 @@
29302930
"type": "array",
29312931
"description": "ExtraWorkloadRules are extra allowed rules for the vCluster workloads."
29322932
},
2933+
"ingress": {
2934+
"$ref": "#/$defs/NetworkPolicyIngress",
2935+
"description": "Ingress rules"
2936+
},
29332937
"annotations": {
29342938
"additionalProperties": {
29352939
"type": "string"
@@ -2948,6 +2952,41 @@
29482952
"additionalProperties": false,
29492953
"type": "object"
29502954
},
2955+
"NetworkPolicyIngress": {
2956+
"properties": {
2957+
"enabled": {
2958+
"type": "boolean",
2959+
"description": "Enabled defines if the network policy should be deployed by vCluster."
2960+
},
2961+
"platform": {
2962+
"type": "boolean",
2963+
"description": "Platform enables ingress access from the loft platform"
2964+
},
2965+
"controlPlaneRules": {
2966+
"items": {
2967+
"type": "object"
2968+
},
2969+
"type": "array",
2970+
"description": "ControlPlaneRules are allowed rules for the vCluster control plane."
2971+
},
2972+
"kubeDnsRules": {
2973+
"items": {
2974+
"type": "object"
2975+
},
2976+
"type": "array",
2977+
"description": "KubeDNSRules are allowed rules for the vCluster workloads."
2978+
},
2979+
"workloadRules": {
2980+
"items": {
2981+
"type": "object"
2982+
},
2983+
"type": "array",
2984+
"description": "WorkloadRules are allowed rules for the vCluster workloads."
2985+
}
2986+
},
2987+
"additionalProperties": false,
2988+
"type": "object"
2989+
},
29512990
"NetworkProxyKubelets": {
29522991
"properties": {
29532992
"byHostname": {

‎chart/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1146,6 +1146,18 @@ policies:
11461146
- 10.0.0.0/8
11471147
- 172.16.0.0/12
11481148
- 192.168.0.0/16
1149+
# Ingress rules
1150+
ingress:
1151+
# Enabled defines if the network policy should be deployed by vCluster.
1152+
enabled: false
1153+
# Platform enables ingress access from the loft platform
1154+
platform: true
1155+
# ControlPlaneRules are allowed rules for the vCluster control plane.
1156+
controlPlaneRules: []
1157+
# KubeDNSRules are allowed rules for the vCluster workloads.
1158+
kubeDnsRules: []
1159+
# WorkloadRules are allowed rules for the vCluster workloads.
1160+
workloadRules: []
11491161

11501162
# CentralAdmission defines what validating or mutating webhooks should be enforced within the virtual cluster.
11511163
centralAdmission:

‎config/config.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2681,9 +2681,29 @@ type NetworkPolicy struct {
26812681
// ExtraWorkloadRules are extra allowed rules for the vCluster workloads.
26822682
ExtraWorkloadRules []map[string]interface{} `json:"extraWorkloadRules,omitempty"`
26832683

2684+
// Ingress rules
2685+
Ingress NetworkPolicyIngress `json:"ingress,omitempty"`
2686+
26842687
LabelsAndAnnotations `json:",inline"`
26852688
}
26862689

2690+
type NetworkPolicyIngress struct {
2691+
// Enabled defines if the network policy should be deployed by vCluster.
2692+
Enabled bool `json:"enabled,omitempty"`
2693+
2694+
// Platform enables ingress access from the loft platform
2695+
Platform bool `json:"platform,omitempty"`
2696+
2697+
// ControlPlaneRules are allowed rules for the vCluster control plane.
2698+
ControlPlaneRules []map[string]interface{} `json:"controlPlaneRules,omitempty"`
2699+
2700+
// KubeDNSRules are allowed rules for the vCluster workloads.
2701+
KubeDNSRules []map[string]interface{} `json:"kubeDnsRules,omitempty"`
2702+
2703+
// WorkloadRules are allowed rules for the vCluster workloads.
2704+
WorkloadRules []map[string]interface{} `json:"workloadRules,omitempty"`
2705+
}
2706+
26872707
type OutgoingConnections struct {
26882708
// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
26892709
// to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs

‎config/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -621,6 +621,12 @@ policies:
621621
- 10.0.0.0/8
622622
- 172.16.0.0/12
623623
- 192.168.0.0/16
624+
ingress:
625+
enabled: false
626+
platform: true
627+
controlPlaneRules: []
628+
kubeDnsRules: []
629+
workloadRules: []
624630

625631
centralAdmission:
626632
validatingWebhooks: []

0 commit comments

Comments
 (0)