Skip to content

Commit fdf4abc

Browse files
ppawlowskippawlowski
authored
feat: Add possibility to specify custom, global Network Policies (#952)
1 parent 44f5d62 commit fdf4abc

6 files changed

Lines changed: 272 additions & 4 deletions

File tree

‎helm/flowfuse/README.md‎

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ For other values please refer to the documentation below.
3535
- `forge.projectSelector` a collection of labels and values to filter nodes that Project Pods will run on (default `role: projects`)
3636
- `forge.projectNamespace` namespace Project Pods will run in (default `flowforge`)
3737
- `forge.projectDeploymentTolerations` tolerations settings for Project instances. Default is `[]`.
38-
- `forge.projectNetworkPolicy.enabled` specified if [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) should be created for project pods ( default `false`)
39-
- `forge.projectNetworkPolicy.ingress` a list of ingress rules for the [Network Policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) applied on project pods ( default `[]`)
40-
- `forge.projectNetworkPolicy.egress` a list of egress rules for the [Network Policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) applied in project pods ( default `[]`)
38+
- `forge.projectNetworkPolicy.enabled` **DEPRECATED** (use the top-level [`networkPolicies`](#network-policies) value instead) specified if [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) should be created for project pods ( default `false`)
39+
- `forge.projectNetworkPolicy.ingress` **DEPRECATED** (use the top-level [`networkPolicies`](#network-policies) value instead) a list of ingress rules for the [Network Policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) applied on project pods ( default `[]`)
40+
- `forge.projectNetworkPolicy.egress` **DEPRECATED** (use the top-level [`networkPolicies`](#network-policies) value instead) a list of egress rules for the [Network Policy](https://kubernetes.io/docs/concepts/services-networking/network-policies/) applied in project pods ( default `[]`)
4141
- `forge.projectIngressClassName` ingress class name for project instances (default is `ingress.className` value if set, otherwise `"""`)
4242
- `forge.projectIngressAnnotations` ingress annotations for project instances (default is `{}`)
4343
- `forge.projectServiceType` service type for project instances (allowed `ClusterIP` or `NodePort`, default is `ClusterIP`)
@@ -391,6 +391,46 @@ readinessProbe:
391391
failureThreshold: 3
392392
```
393393

394+
### Network Policies
395+
396+
The chart can deploy arbitrary [NetworkPolicies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) via the top-level `networkPolicies` value. It is a map keyed by policy name; each entry renders one `NetworkPolicy`. The chart owns `apiVersion`, `kind`, `metadata.name` (the map key), labels and namespace, while `spec` is rendered as-is. Full Helm templating is supported in both keys and values (`.Release.*`, `.Values.*`, helper functions), so policies can target any namespace and any pods.
397+
398+
- `networkPolicies` map of custom NetworkPolicies to deploy as part of this release. Helm templating is supported. (default `{}`)
399+
- `<name>.namespace` namespace the policy is created in (default is the release namespace)
400+
- `<name>.labels` extra labels merged onto the chart labels (default `{}`)
401+
- `<name>.annotations` annotations applied to the policy (default `{}`)
402+
- `<name>.spec` the [NetworkPolicy spec](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/network-policy-v1/#NetworkPolicySpec), rendered verbatim (required)
403+
404+
> **Note:** `forge.projectNetworkPolicy` is deprecated in favour of this value. To reproduce it, target the project namespace and the `nodered: "true"` pods (see the example below).
405+
406+
Example:
407+
408+
```yaml
409+
networkPolicies:
410+
# Equivalent of the deprecated forge.projectNetworkPolicy
411+
flowfuse-projects-policy:
412+
namespace: "{{ .Values.forge.projectNamespace }}"
413+
spec:
414+
podSelector:
415+
matchLabels:
416+
nodered: "true"
417+
policyTypes:
418+
- Ingress
419+
- Egress
420+
ingress:
421+
- from:
422+
- podSelector: {}
423+
egress:
424+
- to:
425+
- namespaceSelector: {}
426+
# Deny all ingress to the release namespace by default
427+
default-deny-ingress:
428+
spec:
429+
podSelector: {}
430+
policyTypes:
431+
- Ingress
432+
```
433+
394434
### Extra Objects
395435

396436
The chart supports deploying arbitrary Kubernetes manifests alongside the main release via `extraObjects`. Each item is rendered as-is, with full Helm templating support (`.Release.*`, `.Values.*`, helper functions).

‎helm/flowfuse/templates/NOTES.txt‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,21 @@
11
Thank you for installing {{ .Chart.Name }} v{{ .Chart.AppVersion }}
22

3-
You can complete the setup wizard at {{ if .Values.forge.entryPoint }}http{{- if .Values.forge.https -}}s{{- end -}}://{{ .Values.forge.entryPoint }}{{- else }}http{{- if .Values.forge.https -}}s{{- end -}}://forge.{{ .Values.forge.domain }}{{- end }}
3+
You can complete the setup wizard at {{ if .Values.forge.entryPoint }}http{{- if .Values.forge.https -}}s{{- end -}}://{{ .Values.forge.entryPoint }}{{- else }}http{{- if .Values.forge.https -}}s{{- end -}}://forge.{{ .Values.forge.domain }}{{- end }}
4+
{{ if (((.Values.forge).projectNetworkPolicy).enabled) }}
5+
[DEPRECATION WARNING] `forge.projectNetworkPolicy` is deprecated and will be
6+
removed in a future release. Please migrate to the top-level `networkPolicies`
7+
value, which can express the same policy:
8+
9+
networkPolicies:
10+
flowfuse-projects-policy:
11+
namespace: "{{ "{{" }} .Values.forge.projectNamespace {{ "}}" }}"
12+
spec:
13+
podSelector:
14+
matchLabels:
15+
nodered: "true"
16+
policyTypes:
17+
- Ingress
18+
- Egress
19+
ingress: [] # your forge.projectNetworkPolicy.ingress rules
20+
egress: [] # your forge.projectNetworkPolicy.egress rules
21+
{{- end }}

‎helm/flowfuse/templates/network-policies.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- range $name, $policy := .Values.networkPolicies }}
2+
---
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: {{ tpl $name $ }}
7+
namespace: {{ tpl ($policy.namespace | default $.Release.Namespace) $ }}
8+
labels:
9+
{{- include "forge.labels" $ | nindent 4 }}
10+
{{- with $policy.labels }}
11+
{{- tpl (toYaml .) $ | nindent 4 }}
12+
{{- end }}
13+
{{- with $policy.annotations }}
14+
annotations:
15+
{{- tpl (toYaml .) $ | nindent 4 }}
16+
{{- end }}
17+
spec:
18+
{{- tpl (toYaml $policy.spec) $ | nindent 4 }}
19+
{{- end }}

‎helm/flowfuse/tests/network-policies_test.yaml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
2+
suite: test custom network policies
3+
templates:
4+
- network-policies.yaml
5+
release:
6+
name: flowfuse
7+
namespace: default
8+
set:
9+
forge.domain: "chart-unit-tests.com"
10+
11+
tests:
12+
- it: should not render anything when networkPolicies is empty (default)
13+
asserts:
14+
- hasDocuments:
15+
count: 0
16+
17+
- it: should render a single network policy
18+
set:
19+
networkPolicies:
20+
deny-all-ingress:
21+
spec:
22+
podSelector: {}
23+
policyTypes:
24+
- Ingress
25+
asserts:
26+
- hasDocuments:
27+
count: 1
28+
- isKind:
29+
of: NetworkPolicy
30+
documentIndex: 0
31+
- isAPIVersion:
32+
of: networking.k8s.io/v1
33+
documentIndex: 0
34+
- equal:
35+
path: metadata.name
36+
value: deny-all-ingress
37+
documentIndex: 0
38+
- equal:
39+
path: spec.policyTypes
40+
value:
41+
- Ingress
42+
documentIndex: 0
43+
44+
- it: should default namespace to the release namespace
45+
set:
46+
networkPolicies:
47+
deny-all-ingress:
48+
spec:
49+
podSelector: {}
50+
policyTypes:
51+
- Ingress
52+
asserts:
53+
- equal:
54+
path: metadata.namespace
55+
value: default
56+
documentIndex: 0
57+
58+
- it: should use the provided namespace when set
59+
set:
60+
networkPolicies:
61+
deny-all-ingress:
62+
namespace: custom-ns
63+
spec:
64+
podSelector: {}
65+
policyTypes:
66+
- Ingress
67+
asserts:
68+
- equal:
69+
path: metadata.namespace
70+
value: custom-ns
71+
documentIndex: 0
72+
73+
- it: should inject chart labels and merge custom labels and annotations
74+
set:
75+
networkPolicies:
76+
deny-all-ingress:
77+
labels:
78+
extra-label: value
79+
annotations:
80+
extra-annotation: value
81+
spec:
82+
podSelector: {}
83+
policyTypes:
84+
- Ingress
85+
asserts:
86+
- equal:
87+
path: metadata.labels["app.kubernetes.io/managed-by"]
88+
value: Helm
89+
documentIndex: 0
90+
- equal:
91+
path: metadata.labels["extra-label"]
92+
value: value
93+
documentIndex: 0
94+
- equal:
95+
path: metadata.annotations["extra-annotation"]
96+
value: value
97+
documentIndex: 0
98+
99+
- it: should render multiple network policies
100+
set:
101+
networkPolicies:
102+
deny-all-ingress:
103+
spec:
104+
podSelector: {}
105+
policyTypes:
106+
- Ingress
107+
allow-egress:
108+
spec:
109+
podSelector: {}
110+
policyTypes:
111+
- Egress
112+
asserts:
113+
- hasDocuments:
114+
count: 2
115+
- containsDocument:
116+
apiVersion: networking.k8s.io/v1
117+
kind: NetworkPolicy
118+
name: deny-all-ingress
119+
any: true
120+
- containsDocument:
121+
apiVersion: networking.k8s.io/v1
122+
kind: NetworkPolicy
123+
name: allow-egress
124+
any: true
125+
126+
- it: should support Helm templating in namespace and spec
127+
set:
128+
forge.projectNamespace: my-projects
129+
networkPolicies:
130+
flowfuse-projects-policy:
131+
namespace: "{{ .Values.forge.projectNamespace }}"
132+
spec:
133+
podSelector:
134+
matchLabels:
135+
nodered: "true"
136+
policyTypes:
137+
- Ingress
138+
asserts:
139+
- equal:
140+
path: metadata.namespace
141+
value: my-projects
142+
documentIndex: 0
143+
- equal:
144+
path: spec.podSelector.matchLabels.nodered
145+
value: "true"
146+
documentIndex: 0

‎helm/flowfuse/values.schema.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@
144144
},
145145
"projectNetworkPolicy": {
146146
"type": "object",
147+
"description": "DEPRECATED: use the top-level `networkPolicies` value instead. This block still works but will be removed in a future release.",
147148
"properties": {
148149
"egress": {
149150
"type": "array"
@@ -1367,6 +1368,29 @@
13671368
}
13681369
}
13691370
},
1371+
"networkPolicies": {
1372+
"type": "object",
1373+
"description": "Custom NetworkPolicies to deploy as part of this release, keyed by policy name. Helm templating is supported.",
1374+
"default": {},
1375+
"additionalProperties": {
1376+
"type": "object",
1377+
"properties": {
1378+
"namespace": {
1379+
"type": "string"
1380+
},
1381+
"labels": {
1382+
"type": "object"
1383+
},
1384+
"annotations": {
1385+
"type": "object"
1386+
},
1387+
"spec": {
1388+
"type": "object"
1389+
}
1390+
},
1391+
"required": ["spec"]
1392+
}
1393+
},
13701394
"extraObjects": {
13711395
"type": "array",
13721396
"description": "Extra Kubernetes manifests to deploy as part of this release. Helm templating is supported.",

‎helm/flowfuse/values.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ forge:
88
projectSelector:
99
role: projects
1010
projectDeploymentTolerations: []
11+
# DEPRECATED: use the top-level `networkPolicies` value instead.
12+
# This block still works but will be removed in a future release.
1113
projectNetworkPolicy:
1214
enabled: false
1315
projectIngressAnnotations: {}
@@ -412,6 +414,25 @@ ingressMigration:
412414
# Tolerations
413415
tolerations: []
414416

417+
# Custom NetworkPolicies to deploy as part of this release.
418+
# A map keyed by policy name; each entry renders a single NetworkPolicy.
419+
# `namespace` defaults to the release namespace. `spec` is rendered verbatim.
420+
# Supports Helm templating in keys and values (e.g. .Release.Name, .Values.*).
421+
networkPolicies: {}
422+
# allow-projects-ingress:
423+
# namespace: "{{ .Values.forge.projectNamespace }}"
424+
# labels: {}
425+
# annotations: {}
426+
# spec:
427+
# podSelector:
428+
# matchLabels:
429+
# nodered: "true"
430+
# policyTypes:
431+
# - Ingress
432+
# ingress:
433+
# - from:
434+
# - podSelector: {}
435+
415436
# Extra Kubernetes manifests to deploy as part of this release.
416437
# Supports Helm templating (e.g. .Release.Name, .Values.*).
417438
extraObjects: []

0 commit comments

Comments
 (0)