Skip to content
Snippets Groups Projects
Verified Commit c82aa6cc authored by Sheogorath's avatar Sheogorath :european_castle:
Browse files

feat(mok): Add network policies to helm chart

This patch adds the needed network policies to the helm chart. This
provides a reasonable base-line setup. Currently any customizations
regarding network access would require additional policies. These might
come in place later on.
parent 489ed11e
No related branches found
No related tags found
No related merge requests found
Pipeline #14018 passed
{{- if .Values.networkPolicy.create }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "mok.fullname" . }}-dovecot
labels:
{{- include "mok.labels" . | nindent 4 }}
app.kubernetes.io/component: dovecot
spec:
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
{{- include "mok.selectorLabels" . | nindent 10 }}
app.kubernetes.io/component: postfix
ports:
- port: 24
protocol: TCP
- port: 12345
protocol: TCP
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 110
protocol: TCP
- port: 143
protocol: TCP
- port: 993
protocol: TCP
- port: 995
protocol: TCP
- port: 4190
protocol: TCP
podSelector:
matchLabels:
{{- include "mok.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: dovecot
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "mok.fullname" . }}-postfix
labels:
{{- include "mok.labels" . | nindent 4 }}
app.kubernetes.io/component: postfix
spec:
policyTypes:
- Ingress
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 25
protocol: TCP
- port: 465
protocol: TCP
- port: 587
protocol: TCP
podSelector:
matchLabels:
{{- include "mok.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: postfix
{{- end }}
matches snapshot:
1: |
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: mok
helm.sh/chart: mok-0.1.0
name: RELEASE-NAME-mok-dovecot
spec:
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/name: mok
ports:
- port: 24
protocol: TCP
- port: 12345
protocol: TCP
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 110
protocol: TCP
- port: 143
protocol: TCP
- port: 993
protocol: TCP
- port: 995
protocol: TCP
- port: 4190
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/name: mok
policyTypes:
- Ingress
2: |
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
labels:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: mok
helm.sh/chart: mok-0.1.0
name: RELEASE-NAME-mok-postfix
spec:
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 25
protocol: TCP
- port: 465
protocol: TCP
- port: 587
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/name: mok
policyTypes:
- Ingress
suite: Kubernetes recommendations suite: Kubernetes recommendations
templates: templates:
- dovecot.yaml - dovecot.yaml
- networkpolicy.yaml
- persistentvolumeclaim.yaml - persistentvolumeclaim.yaml
- postfix.yaml - postfix.yaml
- secret.yaml - secret.yaml
......
suite: Network Policy
templates:
- networkpolicy.yaml
tests:
- it: allows dovecot's lmtp from postfix
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[0].from[0].podSelector.matchLabels
value:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[0].ports
content:
port: 24
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- it: allows dovecot's authentication from postfix
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[0].from[0].podSelector.matchLabels
value:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[0].ports
content:
port: 12345
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- it: allows dovecot's pop3 and pop3s from everywhere
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[1].from[0].ipBlock.cidr
value: 0.0.0.0/0
documentIndex: 0
template: networkpolicy.yaml
- isEmpty:
path: spec.ingress[1].from[0].ipBlock.except
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[1].ports
content:
port: 110
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[1].ports
content:
port: 995
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- it: allows dovecot's imap and imaps from everywhere
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[1].from[0].ipBlock.cidr
value: 0.0.0.0/0
documentIndex: 0
template: networkpolicy.yaml
- isEmpty:
path: spec.ingress[1].from[0].ipBlock.except
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[1].ports
content:
port: 143
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[1].ports
content:
port: 993
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- it: allows dovecot's sieve from everywhere
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[1].from[0].ipBlock.cidr
value: 0.0.0.0/0
documentIndex: 0
template: networkpolicy.yaml
- isEmpty:
path: spec.ingress[1].from[0].ipBlock.except
documentIndex: 0
template: networkpolicy.yaml
- contains:
path: spec.ingress[1].ports
content:
port: 4190
protocol: TCP
documentIndex: 0
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: dovecot
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 0
template: networkpolicy.yaml
- it: allows postfix's smtp from everywhere
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[0].from[0].ipBlock.cidr
value: 0.0.0.0/0
documentIndex: 1
template: networkpolicy.yaml
- isEmpty:
path: spec.ingress[0].from[0].ipBlock.except
documentIndex: 1
template: networkpolicy.yaml
- contains:
path: spec.ingress[0].ports
content:
port: 25
protocol: TCP
documentIndex: 1
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 1
template: networkpolicy.yaml
- it: allows postfix's submission and submissions from everywhere
release:
name: "test-suite"
asserts:
- equal:
path: spec.ingress[0].from[0].ipBlock.cidr
value: 0.0.0.0/0
documentIndex: 1
template: networkpolicy.yaml
- isEmpty:
path: spec.ingress[0].from[0].ipBlock.except
documentIndex: 1
template: networkpolicy.yaml
- contains:
path: spec.ingress[0].ports
content:
port: 465
protocol: TCP
documentIndex: 1
template: networkpolicy.yaml
- contains:
path: spec.ingress[0].ports
content:
port: 587
protocol: TCP
documentIndex: 1
template: networkpolicy.yaml
- equal:
path: spec.podSelector.matchLabels
value:
app.kubernetes.io/component: postfix
app.kubernetes.io/instance: test-suite
app.kubernetes.io/name: mok
documentIndex: 1
template: networkpolicy.yaml
- it: matches snapshot
asserts:
- matchSnapshot: {}
...@@ -182,3 +182,6 @@ serviceAccount: ...@@ -182,3 +182,6 @@ serviceAccount:
# The name of the service account to use. # The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template # If not set and create is true, a name is generated using the fullname template
name: "" name: ""
networkPolicy:
create: true
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment