Apply suggestions from review

Author: Debakel Orakel

component/main.jsonnet

@@ -81,36 +81,43 @@ local secrets = com.generateResources(
   }
 );
 
-local netpols = kube.NetworkPolicy('allow-from-other-namespaces') {
-  metadata+: {
-    labels+: {
-      'app.kubernetes.io/managed-by': 'commodore',
-      'app.kubernetes.io/name': 'allow-from-other-namespaces',
+local netpols =
+  local exposedComponents = com.renderArray(params.networkPolicy.exposedComponents);
+  local allowedNamespaces = com.renderArray(params.networkPolicy.allowedNamespaces);
+  if
+    params.networkPolicy.enabled
+    && std.length(exposedComponents) > 0
+    && std.length(allowedNamespaces) > 0
+  then kube.NetworkPolicy('allow-from-other-namespaces') {
+    metadata+: {
+      labels+: {
+        'app.kubernetes.io/managed-by': 'commodore',
+        'app.kubernetes.io/name': 'allow-from-other-namespaces',
+      },
+      namespace: params.namespace.name,
     },
-    namespace: params.namespace.name,
-  },
-  spec: {
-    policyTypes: [ 'Ingress' ],
-    [if std.length(params.networkPolicy.exposedComponents) > 0 then 'podSelector']: {
-      matchExpressions: [ {
-        key: 'app.kubernetes.io/component',
-        operator: 'In',
-        values: com.renderArray(params.networkPolicy.exposedComponents),
+    spec: {
+      policyTypes: [ 'Ingress' ],
+      podSelector: {
+        matchExpressions: [ {
+          key: 'app.kubernetes.io/component',
+          operator: 'In',
+          values: exposedComponents,
+        } ],
+      },
+      ingress: [ {
+        from: [ {
+          namespaceSelector: {
+            matchExpressions: [ {
+              key: 'kubernetes.io/metadata.name',
+              operator: 'In',
+              values: allowedNamespaces,
+            } ],
+          },
+        } ],
       } ],
     },
-    ingress: [ {
-      from: [ {
-        namespaceSelector: {
-          matchExpressions: [ {
-            key: 'kubernetes.io/metadata.name',
-            operator: 'In',
-            values: com.renderArray(params.networkPolicy.allowedNamespaces),
-          } ],
-        },
-      } ],
-    } ],
-  },
-};
+  } else {};
 
 // Define outputs below
 {
@@ -126,5 +133,5 @@ local netpols = kube.NetworkPolicy('allow-from-other-namespaces') {
       namespace: params.namespace.name,
     },
   },
-  [if params.networkPolicy.enabled && std.length(params.networkPolicy.allowedNamespaces) > 0 then '30_network_policies']: netpols,
+  [if std.length(netpols) > 0 then '30_network_policies']: netpols,
 }

docs/modules/ROOT/pages/references/parameters.adoc

@@ -594,6 +594,10 @@ Configure access- and secret key for the S3 storage.
 
 Configure the NetworkPolicy if necessary.
 
+[TIP]
+====
+The NetworkPolicy will only be deployed if it is `enabled` and has at least 1 entry in `allowedNamespaces`.
+
 === `networkPolicy.enabled`
 
 [horizontal]
@@ -615,6 +619,14 @@ The networkPolicy will only be deployed if it is `enabled` and has at least 1 en
 
 === `networkPolicy.enabled`
 
+[horizontal]
+type:: boolean
+default:: true
+
+Enable or disable the creation of NetworkPolicies.
+
+=== `networkPolicy.exposedComponents`
+
 [horizontal]
 type:: dict
 default::

tests/extra-config.yml

@@ -42,7 +42,6 @@ parameters:
       region: 'us-east-1'
 
     networkPolicy:
-      enabled: false
       allowedNamespaces:
         - vshn-grafana
 

…shift/loki/loki/30_network_policies.yaml …onfig/loki/loki/30_network_policies.yamltests/golden/openshift/loki/loki/30_network_policies.yaml renamed to tests/golden/extra-config/loki/loki/30_network_policies.yaml tests/golden/openshift/loki/loki/30_network_policies.yaml renamed to tests/golden/extra-config/loki/loki/30_network_policies.yaml

@@ -17,5 +17,12 @@ spec:
                 operator: In
                 values:
                   - vshn-grafana
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - gateway
+          - query-frontend
   policyTypes:
     - Ingress