DevFW-CICD/argocd-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(argo-cd): Add ability to create network policies (#800)

Browse source 
Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>
This commit is contained in:
Marco Kilchhofer 2021-07-13 08:35:25 +02:00 • committed by GitHub
parent 9c69a87f67
commit 922799081d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 149 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
charts/argo-cd/templates/argocd-application-controller/networkpolicy.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if .Values.global.networkPolicy.create }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
name: {{ template "argo-cd.controller.fullname" . }}
spec:
ingress:
- from:
- namespaceSelector: {}
ports:
- port: controller
podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
policyTypes:
- Ingress
{{- end }}

31
charts/argo-cd/templates/argocd-repo-server/networkpolicy.yaml Normal file
View file

@ -0,0 +1,31 @@
{{- if .Values.global.networkPolicy.create }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" . "component" .Values.repoServer.name "name" .Values.repoServer.name) | nindent 4 }}
name: {{ template "argo-cd.repoServer.fullname" . }}
spec:
ingress:
- from:
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 10 }}
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 10 }}
ports:
- port: repo-server
protocol: TCP
{{- if .Values.repoServer.metrics.enabled }}
- from:
- namespaceSelector: {}
ports:
- port: metrics
{{- end }}
podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.repoServer.name) | nindent 6 }}
policyTypes:
- Ingress
{{- end }}

16
charts/argo-cd/templates/argocd-server/networkpolicy.yaml Normal file
View file

@ -0,0 +1,16 @@
{{- if .Values.global.networkPolicy.create }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
name: {{ template "argo-cd.server.fullname" . }}
spec:
ingress:
- {}
podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 6 }}
policyTypes:
- Ingress
{{- end }}

31
charts/argo-cd/templates/dex/networkpolicy.yaml Normal file
View file

@ -0,0 +1,31 @@
{{- if and .Values.global.networkPolicy.create .Values.dex.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" . "component" .Values.dex.name "name" .Values.dex.name) | nindent 4 }}
name: {{ template "argo-cd.dex.fullname" . }}
spec:
ingress:
- from:
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 10 }}
ports:
- port: http
protocol: TCP
- port: grpc
protocol: TCP
{{- if .Values.dex.metrics.enabled }}
- from:
- namespaceSelector: {}
ports:
- port: metrics
protocol: TCP
{{- end }}
podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.dex.name) | nindent 6 }}
policyTypes:
- Ingress
{{- end }}

12
charts/argo-cd/templates/networkpolicy-default-deny.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if and .Values.global.networkPolicy.create .Values.global.networkPolicy.defaultDenyIngress }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" .) | nindent 4 }}
name: {{ template "argo-cd.fullname" . }}-default-deny
spec:
podSelector: {}
policyTypes:
- Ingress
{{- end }}

2
charts/argo-cd/templates/redis/deployment.yaml
View file

@ -59,8 +59,8 @@ spec:
{{- end }}
ports:
- containerPort: {{ .Values.redis.containerPort }}
name: redis
{{- if .Values.redis.volumeMounts }}
volumeMounts:
{{- toYaml .Values.redis.volumeMounts | nindent 10 }}
{{- end }}

29
charts/argo-cd/templates/redis/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
{{- $redisHa := (index .Values "redis-ha") -}}
{{- if and .Values.global.networkPolicy.create .Values.redis.enabled (not $redisHa.enabled) }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
{{- include "argo-cd.labels" (dict "context" . "component" .Values.redis.name "name" .Values.redis.name) | nindent 4 }}
name: {{ template "argo-cd.redis.fullname" . }}
spec:
ingress:
- from:
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 10 }}
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.repoServer.name) | nindent 10 }}
- podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 10 }}
ports:
- port: redis
protocol: TCP
podSelector:
matchLabels:
{{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.redis.name) | nindent 6 }}
policyTypes:
- Ingress
{{- end }}