feat(charts): Add optional networkPolicy (#5779)

Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>
Signed-off-by: Pat Riehecky <riehecky@fnal.gov>

deploy/charts/external-secrets/README.md

@@ -70,12 +70,16 @@ The command removes all the Kubernetes components associated with the chart and
 | certController.metrics.service.annotations | object | `{}` | Additional service annotations |
 | certController.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics |
 | certController.metrics.service.port | int | `8080` | Metrics service port to scrape |
+| certController.networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets certController |
+| certController.networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are:   DNS (53/udp, 53/tcp)   API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs |
+| certController.networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. |
+| certController.networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"}]}]` | The ingress traffic Should match the health and (optionally) metrics port |
 | certController.nodeSelector | object | `{}` |  |
 | certController.podAnnotations | object | `{}` | Annotations to add to Pod |
 | certController.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1,"nameOverride":""}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
 | certController.podLabels | object | `{}` |  |
 | certController.podSecurityContext.enabled | bool | `true` |  |
-| certController.priorityClassName | string | `""` | Pod priority class name. |
+| certController.priorityClassName | string | `""` |  |
 | certController.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
 | certController.readinessProbe.address | string | `""` |  |
 | certController.readinessProbe.enabled | bool | `true` |  |
@@ -187,6 +191,10 @@ The command removes all the Kubernetes components associated with the chart and
 | metrics.service.port | int | `8080` | Metrics service port to scrape |
 | nameOverride | string | `""` |  |
 | namespaceOverride | string | `""` |  |
+| networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8082,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets |
+| networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are:   DNS (53/udp, 53/tcp)   API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs |
+| networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. |
+| networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8082,"protocol":"TCP"}]}]` | The ingress traffic Should match the health and (optionally) metrics port |
 | nodeSelector | object | `{}` |  |
 | openshiftFinalizers | bool | `true` | If true the OpenShift finalizer permissions will be added to RBAC |
 | podAnnotations | object | `{}` | Annotations to add to Pod |
@@ -301,6 +309,10 @@ The command removes all the Kubernetes components associated with the chart and
 | webhook.metrics.service.annotations | object | `{}` | Additional service annotations |
 | webhook.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics |
 | webhook.metrics.service.port | int | `8080` | Metrics service port to scrape |
+| webhook.networkPolicy | object | `{"egress":[],"enabled":false,"ingress":[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"},{"port":10250,"protocol":"TCP"}]}]}` | Setup a networkPolicy for external-secrets webhook |
+| webhook.networkPolicy.egress | list | `[]` | The egress traffic The minimum egress ports required to function are:   DNS (53/udp, 53/tcp)   API server (80/tcp, 443/tcp, or 6443/tcp) You will need to customize this value to meet your needs |
+| webhook.networkPolicy.enabled | bool | `false` | Specifies whether the networkPolicy should be created. |
+| webhook.networkPolicy.ingress | list | `[{"ports":[{"port":8080,"protocol":"TCP"},{"port":8081,"protocol":"TCP"},{"port":10250,"protocol":"TCP"}]}]` | The ingress traffic Should match the webhook, health, and (optionally) metrics port |
 | webhook.nodeSelector | object | `{}` |  |
 | webhook.podAnnotations | object | `{}` | Annotations to add to Pod |
 | webhook.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1,"nameOverride":""}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |

deploy/charts/external-secrets/templates/cert-controller-networkpolicy.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.certController.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "external-secrets.fullname" . }}-cert-controller-network-policy
+  namespace: {{ include "external-secrets.namespace" . }}
+  labels:
+    {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+  {{- with .Values.certController.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  egress:
+    {{- with .Values.certController.networkPolicy.egress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  ingress:
+    {{- with .Values.certController.networkPolicy.ingress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Egress
+  - Ingress
+{{- end }}

deploy/charts/external-secrets/templates/networkpolicy.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "external-secrets.fullname" . }}-network-policy
+  namespace: {{ include "external-secrets.namespace" . }}
+  labels:
+    {{- include "external-secrets.labels" . | nindent 4 }}
+  {{- with .Values.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  egress:
+    {{- with .Values.networkPolicy.egress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  ingress:
+    {{- with .Values.networkPolicy.ingress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "external-secrets.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Egress
+  - Ingress
+{{- end }}

deploy/charts/external-secrets/templates/webhook-networkpolicy.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.webhook.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "external-secrets.fullname" . }}-webhook-network-policy
+  namespace: {{ include "external-secrets.namespace" . }}
+  labels:
+    {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+  {{- with .Values.webhook.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  egress:
+    {{- with .Values.webhook.networkPolicy.egress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  ingress:
+    {{- with .Values.webhook.networkPolicy.ingress }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Egress
+  - Ingress
+{{- end }}

deploy/charts/external-secrets/tests/cert_controller_networkpolicy_test.yaml

@@ -0,0 +1,97 @@
+suite: test cert controller networkpolicy
+templates:
+  - cert-controller-networkpolicy.yaml
+tests:
+  - it: should create a networkPolicy
+    set:
+      certController.networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.policyTypes
+          value:
+            - Egress
+            - Ingress
+  - it: should not create a networkPolicy
+    set:
+      certController.networkPolicy.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: should set correct pod selector
+    set:
+      certController.networkPolicy.enabled: true
+    asserts:
+      - isNotEmpty:
+          path: spec.podSelector.matchLabels
+      - equal:
+          path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
+          value: external-secrets-cert-controller
+  - it: should apply default ingress ports
+    set:
+      certController.networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.ingress[0].ports
+          value:
+            - protocol: TCP
+              port: 8080
+            - protocol: TCP
+              port: 8081
+  - it: should allow custom ingress CIDR blocks
+    set:
+      certController.networkPolicy.enabled: true
+      certController.networkPolicy.ingress:
+        - from:
+            - ipBlock:
+                cidr: 172.16.0.0/12
+          ports:
+            - protocol: TCP
+              port: 8080
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].ipBlock.cidr
+          value: 172.16.0.0/12
+  - it: should allow custom ingress pod selector
+    set:
+      certController.networkPolicy.enabled: true
+      certController.networkPolicy.ingress:
+        - from:
+            - podSelector:
+                matchLabels:
+                  monitoring: prometheus
+          ports:
+            - protocol: TCP
+              port: 8080
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].podSelector.matchLabels.monitoring
+          value: prometheus
+  - it: should allow custom egress CIDR blocks
+    set:
+      certController.networkPolicy.enabled: true
+      certController.networkPolicy.egress:
+        - to:
+            - ipBlock:
+                cidr: 0.0.0.0/0
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 0.0.0.0/0
+  - it: should allow custom egress pod selector
+    set:
+      certController.networkPolicy.enabled: true
+      certController.networkPolicy.egress:
+        - to:
+            - podSelector:
+                matchLabels:
+                  k8s-app: kube-dns
+          ports:
+            - protocol: UDP
+              port: 53
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].podSelector.matchLabels["k8s-app"]
+          value: kube-dns

deploy/charts/external-secrets/tests/networkpolicy_test.yaml

@@ -0,0 +1,97 @@
+suite: test external-secrets networkpolicy
+templates:
+  - networkpolicy.yaml
+tests:
+  - it: should create a networkPolicy
+    set:
+      networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.policyTypes
+          value:
+            - Egress
+            - Ingress
+  - it: should not create a networkPolicy
+    set:
+      networkPolicy.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: should set correct pod selector
+    set:
+      networkPolicy.enabled: true
+    asserts:
+      - isNotEmpty:
+          path: spec.podSelector.matchLabels
+      - equal:
+          path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
+          value: external-secrets
+  - it: should apply default ingress ports
+    set:
+      networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.ingress[0].ports
+          value:
+            - protocol: TCP
+              port: 8080
+            - protocol: TCP
+              port: 8082
+  - it: should allow custom ingress CIDR blocks
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.ingress:
+        - from:
+            - ipBlock:
+                cidr: 10.0.0.0/8
+          ports:
+            - protocol: TCP
+              port: 8080
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].ipBlock.cidr
+          value: 10.0.0.0/8
+  - it: should allow custom ingress pod selector
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.ingress:
+        - from:
+            - podSelector:
+                matchLabels:
+                  app: prometheus
+          ports:
+            - protocol: TCP
+              port: 8080
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].podSelector.matchLabels.app
+          value: prometheus
+  - it: should allow custom egress CIDR blocks
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress:
+        - to:
+            - ipBlock:
+                cidr: 0.0.0.0/0
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 0.0.0.0/0
+  - it: should allow custom egress pod selector
+    set:
+      networkPolicy.enabled: true
+      networkPolicy.egress:
+        - to:
+            - podSelector:
+                matchLabels:
+                  k8s-app: kube-dns
+          ports:
+            - protocol: UDP
+              port: 53
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].podSelector.matchLabels["k8s-app"]
+          value: kube-dns

deploy/charts/external-secrets/tests/webhook_networkpolicy_test.yaml

@@ -0,0 +1,99 @@
+suite: test webhook networkpolicy
+templates:
+  - webhook-networkpolicy.yaml
+tests:
+  - it: should create a networkPolicy
+    set:
+      webhook.networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.policyTypes
+          value:
+            - Egress
+            - Ingress
+  - it: should not create a networkPolicy
+    set:
+      webhook.networkPolicy.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: should set correct pod selector
+    set:
+      webhook.networkPolicy.enabled: true
+    asserts:
+      - isNotEmpty:
+          path: spec.podSelector.matchLabels
+      - equal:
+          path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
+          value: external-secrets-webhook
+  - it: should apply default ingress ports
+    set:
+      webhook.networkPolicy.enabled: true
+    asserts:
+      - equal:
+          path: spec.ingress[0].ports
+          value:
+            - protocol: TCP
+              port: 8080
+            - protocol: TCP
+              port: 8081
+            - protocol: TCP
+              port: 10250
+  - it: should allow custom ingress CIDR blocks
+    set:
+      webhook.networkPolicy.enabled: true
+      webhook.networkPolicy.ingress:
+        - from:
+            - ipBlock:
+                cidr: 192.168.0.0/16
+          ports:
+            - protocol: TCP
+              port: 10250
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].ipBlock.cidr
+          value: 192.168.0.0/16
+  - it: should allow custom ingress pod selector
+    set:
+      webhook.networkPolicy.enabled: true
+      webhook.networkPolicy.ingress:
+        - from:
+            - podSelector:
+                matchLabels:
+                  app: api-server
+          ports:
+            - protocol: TCP
+              port: 10250
+    asserts:
+      - equal:
+          path: spec.ingress[0].from[0].podSelector.matchLabels.app
+          value: api-server
+  - it: should allow custom egress CIDR blocks
+    set:
+      webhook.networkPolicy.enabled: true
+      webhook.networkPolicy.egress:
+        - to:
+            - ipBlock:
+                cidr: 0.0.0.0/0
+          ports:
+            - protocol: TCP
+              port: 443
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].ipBlock.cidr
+          value: 0.0.0.0/0
+  - it: should allow custom egress pod selector
+    set:
+      webhook.networkPolicy.enabled: true
+      webhook.networkPolicy.egress:
+        - to:
+            - podSelector:
+                matchLabels:
+                  k8s-app: kube-dns
+          ports:
+            - protocol: UDP
+              port: 53
+    asserts:
+      - equal:
+          path: spec.egress[0].to[0].podSelector.matchLabels["k8s-app"]
+          value: kube-dns

deploy/charts/external-secrets/values.schema.json

@@ -167,6 +167,42 @@
                         }
                     }
                 },
+                "networkPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "egress": {
+                            "type": "array"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "ingress": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "ports": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "object",
+                                            "properties": {
+                                                "port": {
+                                                    "type": [
+                                                        "string",
+                                                        "integer"
+                                                    ]
+                                                },
+                                                "protocol": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "nodeSelector": {
                     "type": "object"
                 },
@@ -665,6 +701,42 @@
         "namespaceOverride": {
             "type": "string"
         },
+        "networkPolicy": {
+            "type": "object",
+            "properties": {
+                "egress": {
+                    "type": "array"
+                },
+                "enabled": {
+                    "type": "boolean"
+                },
+                "ingress": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "ports": {
+                                "type": "array",
+                                "items": {
+                                    "type": "object",
+                                    "properties": {
+                                        "port": {
+                                            "type": [
+                                                "string",
+                                                "integer"
+                                            ]
+                                        },
+                                        "protocol": {
+                                            "type": "string"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "nodeSelector": {
             "type": "object"
         },
@@ -1161,6 +1233,42 @@
                         }
                     }
                 },
+                "networkPolicy": {
+                    "type": "object",
+                    "properties": {
+                        "egress": {
+                            "type": "array"
+                        },
+                        "enabled": {
+                            "type": "boolean"
+                        },
+                        "ingress": {
+                            "type": "array",
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "ports": {
+                                        "type": "array",
+                                        "items": {
+                                            "type": "object",
+                                            "properties": {
+                                                "port": {
+                                                    "type": [
+                                                        "string",
+                                                        "integer"
+                                                    ]
+                                                },
+                                                "protocol": {
+                                                    "type": "string"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "nodeSelector": {
                     "type": "object"
                 },

deploy/charts/external-secrets/values.yaml

@@ -443,6 +443,27 @@ hostNetwork: false
 # @schema type: [boolean, null]
 hostUsers:
 
+# -- Setup a networkPolicy for external-secrets
+networkPolicy:
+  # -- Specifies whether the networkPolicy should be created.
+  enabled: false
+  # -- The ingress traffic
+  # Should match the health and (optionally) metrics port
+  ingress:
+  - ports:
+    - protocol: TCP
+      # @schema type: [string, integer]
+      port: 8080  # metrics port
+    - protocol: TCP
+      # @schema type: [string, integer]
+      port: 8082  # health port
+  # -- The egress traffic
+  # The minimum egress ports required to function are:
+  #   DNS (53/udp, 53/tcp)
+  #   API server (80/tcp, 443/tcp, or 6443/tcp)
+  # You will need to customize this value to meet your needs
+  egress: []
+
 webhook:
   # -- Annotations to place on validating webhook configuration.
   annotations: {}
@@ -468,6 +489,31 @@ webhook:
   # -- (bool) Specifies if webhook pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33.
   # @schema type: [boolean, null]
   hostUsers:
+
+  # -- Setup a networkPolicy for external-secrets webhook
+  networkPolicy:
+    # -- Specifies whether the networkPolicy should be created.
+    enabled: false
+    # -- The ingress traffic
+    # Should match the webhook, health, and (optionally) metrics port
+    ingress:
+    - ports:
+      - protocol: TCP
+        # @schema type: [string, integer]
+        port: 8080  # metrics port
+      - protocol: TCP
+        # @schema type: [string, integer]
+        port: 8081  # health port
+      - protocol: TCP
+        # @schema type: [string, integer]
+        port: 10250  # webhook port
+    # -- The egress traffic
+    # The minimum egress ports required to function are:
+    #   DNS (53/udp, 53/tcp)
+    #   API server (80/tcp, 443/tcp, or 6443/tcp)
+    # You will need to customize this value to meet your needs
+    egress: []
+
   image:
     repository: ghcr.io/external-secrets/external-secrets
     pullPolicy: IfNotPresent
@@ -737,6 +783,27 @@ certController:
   # @schema type: [boolean, null]
   hostUsers:
 
+  # -- Setup a networkPolicy for external-secrets certController
+  networkPolicy:
+    # -- Specifies whether the networkPolicy should be created.
+    enabled: false
+    # -- The ingress traffic
+    # Should match the health and (optionally) metrics port
+    ingress:
+    - ports:
+      - protocol: TCP
+        # @schema type: [string, integer]
+        port: 8080  # metrics port
+      - protocol: TCP
+        # @schema type: [string, integer]
+        port: 8081  # health port
+    # -- The egress traffic
+    # The minimum egress ports required to function are:
+    #   DNS (53/udp, 53/tcp)
+    #   API server (80/tcp, 443/tcp, or 6443/tcp)
+    # You will need to customize this value to meet your needs
+    egress: []
+
     # -- Pod priority class name.
   priorityClassName: ""