-
Notifications
You must be signed in to change notification settings - Fork 3.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Helm: add cilium networkpolicies (#11425)
**What this PR does / why we need it**: This PR adds `ciliumnetworkpolicies` that are equivalent to the standard `networkpolicies` already present in the templates. As `cilium` usage as a CNI is rising and the usage of `ciliumnetworkpolicies` is more and more widespread, having the possibility to deploy those directly from a setting in the values would be a time-saving option for a lot of deployments. **Special notes for your reviewer**: **Checklist** - [x] Reviewed the [`CONTRIBUTING.md`](https://github.com/grafana/loki/blob/main/CONTRIBUTING.md) guide (**required**) - [ ] Documentation added - [ ] Tests updated - [x] `CHANGELOG.md` updated - [ ] If the change is worth mentioning in the release notes, add `add-to-release-notes` label - [ ] Changes that require user attention or interaction to upgrade are documented in `docs/sources/setup/upgrade/_index.md` - [x] For Helm chart changes bump the Helm chart version in `production/helm/loki/Chart.yaml` and update `production/helm/loki/CHANGELOG.md` and `production/helm/loki/README.md`. [Example PR](d10549e) - [ ] If the change is deprecating or removing a configuration option, update the `deprecated-config.yaml` and `deleted-config.yaml` files respectively in the `tools/deprecated-config-checker` directory. [Example PR](0d4416a) --------- Signed-off-by: QuantumEnigmaa <[email protected]>
- Loading branch information
1 parent
bfc2312
commit f0ec743
Showing
7 changed files
with
203 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
184 changes: 184 additions & 0 deletions
184
production/helm/loki/templates/ciliumnetworkpolicy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,184 @@ | ||
{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "cilium") }} | ||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-namespace-only | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: {} | ||
egress: | ||
- toEndpoints: | ||
- {} | ||
ingress: | ||
- fromEndpoints: | ||
- {} | ||
|
||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-egress-dns | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchLabels: | ||
{{- include "loki.selectorLabels" . | nindent 6 }} | ||
egress: | ||
- toPorts: | ||
- ports: | ||
- port: dns | ||
protocol: UDP | ||
toEndpoints: | ||
- namespaceSelector: {} | ||
|
||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-ingress | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchExpressions: | ||
- key: app.kubernetes.io/component | ||
operator: In | ||
values: | ||
{{- if .Values.gateway.enabled }} | ||
- gateway | ||
{{- else }} | ||
- read | ||
- write | ||
{{- end }} | ||
matchLabels: | ||
{{- include "loki.selectorLabels" . | nindent 6 }} | ||
ingress: | ||
- toPorts: | ||
- port: http | ||
protocol: TCP | ||
{{- if .Values.networkPolicy.ingress.namespaceSelector }} | ||
fromEndpoints: | ||
- matchLabels: | ||
{{- toYaml .Values.networkPolicy.ingress.namespaceSelector | nindent 8 }} | ||
{{- if .Values.networkPolicy.ingress.podSelector }} | ||
{{- toYaml .Values.networkPolicy.ingress.podSelector | nindent 8 }} | ||
{{- end }} | ||
{{- end }} | ||
|
||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-ingress-metrics | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchLabels: | ||
{{- include "loki.selectorLabels" . | nindent 6 }} | ||
ingress: | ||
- toPorts: | ||
- port: http-metrics | ||
protocol: TCP | ||
{{- if .Values.networkPolicy.metrics.cidrs }} | ||
{{- range $cidr := .Values.networkPolicy.metrics.cidrs }} | ||
toCIDR: | ||
- {{ $cidr }} | ||
{{- end }} | ||
{{- if .Values.networkPolicy.metrics.namespaceSelector }} | ||
fromEndpoints: | ||
- matchLabels: | ||
{{- toYaml .Values.networkPolicy.metrics.namespaceSelector | nindent 8 }} | ||
{{- if .Values.networkPolicy.metrics.podSelector }} | ||
{{- toYaml .Values.networkPolicy.metrics.podSelector | nindent 8 }} | ||
{{- end }} | ||
{{- end }} | ||
{{- end }} | ||
|
||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-egress-alertmanager | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchLabels: | ||
{{- include "loki.backendSelectorLabels" . | nindent 6 }} | ||
egress: | ||
- toPorts: | ||
- port: {{ .Values.networkPolicy.alertmanager.port }} | ||
protocol: TCP | ||
{{- if .Values.networkPolicy.alertmanager.namespaceSelector }} | ||
toEndpoints: | ||
- matchLabels: | ||
{{- toYaml .Values.networkPolicy.alertmanager.namespaceSelector | nindent 8 }} | ||
{{- if .Values.networkPolicy.alertmanager.podSelector }} | ||
{{- toYaml .Values.networkPolicy.alertmanager.podSelector | nindent 8 }} | ||
{{- end }} | ||
{{- end }} | ||
|
||
{{- if .Values.networkPolicy.externalStorage.ports }} | ||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-egress-external-storage | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchLabels: | ||
{{- include "loki.selectorLabels" . | nindent 6 }} | ||
egress: | ||
- toPorts: | ||
{{- range $port := .Values.networkPolicy.externalStorage.ports }} | ||
- port: {{ $port }} | ||
protocol: TCP | ||
{{- end }} | ||
{{- if .Values.networkPolicy.externalStorage.cidrs }} | ||
{{- range $cidr := .Values.networkPolicy.externalStorage.cidrs }} | ||
toCIDR: | ||
- {{ $cidr }} | ||
{{- end }} | ||
{{- end }} | ||
{{- end }} | ||
|
||
{{- end }} | ||
|
||
{{- if .Values.networkPolicy.discovery.port }} | ||
--- | ||
apiVersion: cilium.io/v2 | ||
kind: CiliumNetworkPolicy | ||
metadata: | ||
name: {{ include "loki.name" . }}-egress-discovery | ||
namespace: {{ $.Release.Namespace }} | ||
labels: | ||
{{- include "loki.labels" . | nindent 4 }} | ||
spec: | ||
endpointSelector: | ||
matchLabels: | ||
{{- include "loki.selectorLabels" . | nindent 6 }} | ||
egress: | ||
- toPorts: | ||
- port: {{ .Values.networkPolicy.discovery.port }} | ||
protocol: TCP | ||
{{- if .Values.networkPolicy.discovery.namespaceSelector }} | ||
toEndpoints: | ||
- matchLabels: | ||
{{- toYaml .Values.networkPolicy.discovery.namespaceSelector | nindent 8 }} | ||
{{- if .Values.networkPolicy.discovery.podSelector }} | ||
{{- toYaml .Values.networkPolicy.discovery.podSelector | nindent 8 }} | ||
{{- end }} | ||
{{- end }} | ||
{{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters