feat(helm): add networkPolicy (#336)

* feat(txdc): add networkPolicy Signed-off-by: Marco Lecheler <[email protected]> * chore(txdc): allow traffic from any ns/pod via netPol Signed-off-by: Marco Lecheler <[email protected]> * chore(txdc): unify netPol into one resource Instead of two separate templatings cp and dp will be templated in one Signed-off-by: Marco Lecheler <[email protected]> * fix(txdc): disable netPol by default * chore(chart): update licence header * fix(helm): use namespaceSelector as default netPol from Signed-off-by: Marco Lecheler <[email protected]> * chore(chart): fix netPol from indent Using same indentation as other templates for lists Signed-off-by: Marco Lecheler <[email protected]> * feat(chart): add netPol policyTypes Signed-off-by: Marco Lecheler <[email protected]> * chore: update licence header --------- Signed-off-by: Marco Lecheler <[email protected]>
eclipse-tractusx · Jun 7, 2023 · fef0c63 · fef0c63
1 parent 95c9ee4
commit fef0c63
Show file tree

Hide file tree

Showing 2 changed files with 60 additions and 0 deletions.
diff --git a/charts/tractusx-connector/templates/networkpolicy.yaml b/charts/tractusx-connector/templates/networkpolicy.yaml
@@ -0,0 +1,45 @@
+#
+#  Copyright (c) 2023 Contributors to the Eclipse Foundation
+#
+#  See the NOTICE file(s) distributed with this work for additional
+#  information regarding copyright ownership.
+#
+#  This program and the accompanying materials are made available under the
+#  terms of the Apache License, Version 2.0 which is available at
+#  https://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+
+{{- if eq (.Values.networkPolicy.enabled | toString) "true" }}
+{{- range tuple "controlplane" "dataplane" }}
+{{- $name := . }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "txdc.fullname" $ }}-{{ $name }}
+  labels:
+    {{- include (printf "txdc.%s.labels" $name) $ | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include (printf "txdc.%s.selectorLabels" $name) $ | nindent 6 }}
+  ingress:
+    - from:
+      {{- toYaml (index $.Values.networkPolicy $name "from") | nindent 6 }}
+      ports:
+      {{- range $key,$value := (index $.Values $name "endpoints") }}
+        - port: {{ $value.port }}
+          protocol: TCP
+      {{- end }}
+  policyTypes:
+    - Ingress
+---
+{{- end }}
+{{- end }}
diff --git a/charts/tractusx-connector/values.yaml b/charts/tractusx-connector/values.yaml
@@ -543,6 +543,21 @@ daps:
       certificate: ""    # must be set externally!
 backendService:
   httpProxyTokenReceiverUrl: ""
+
+networkPolicy:
+  # -- If `true` network policy will be created to restrict access to control- and dataplane
+  enabled: false
+  # -- Configuration of the controlplane component
+  controlplane:
+    # -- Specify from rule network policy for cp (defaults to all namespaces)
+    from:
+    - namespaceSelector: {}
+  # -- Configuration of the dataplane component
+  dataplane:
+    # -- Specify from rule network policy for dp (defaults to all namespaces)
+    from:
+    - namespaceSelector: {}
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true