diff --git a/charts/node-readiness-controller/README.md b/charts/node-readiness-controller/README.md index b58d3b97..a62997e0 100644 --- a/charts/node-readiness-controller/README.md +++ b/charts/node-readiness-controller/README.md @@ -63,6 +63,9 @@ The following table lists the configurable parameters of the _node-readiness-con | `podDisruptionBudget.enabled` | Enable PodDisruptionBudget for the controller | `false` | | `podDisruptionBudget.minAvailable` | Minimum number of available controller pods | `1` | | `podDisruptionBudget.maxUnavailable` | Maximum number of unavailable controller pods | `nil` | +| `networkPolicy.enabled` | Enable a NetworkPolicy isolating the controller pods (review the generated rules for your cluster first) | `false` | +| `networkPolicy.ingress` | Extra ingress rules appended verbatim to the generated ones | `[]` | +| `networkPolicy.egress` | Extra egress rules appended verbatim to the generated ones | `[]` | | `controller.kubeAPIQPS` | Maximum QPS to the Kubernetes API server. `-1` means no limit. | `-1` | | `controller.kubeAPIBurst` | Maximum burst for throttled API server requests. `-1` means no limit. | `-1` | | `controller.nodeConcurrentReconciles` | Maximum number of Node objects reconciled concurrently. Raise on large clusters. | `1` | diff --git a/charts/node-readiness-controller/templates/networkpolicy.yaml b/charts/node-readiness-controller/templates/networkpolicy.yaml new file mode 100644 index 00000000..86ca2131 --- /dev/null +++ b/charts/node-readiness-controller/templates/networkpolicy.yaml @@ -0,0 +1,50 @@ +{{- if .Values.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "node-readiness-controller.fullname" . }} + namespace: {{ include "node-readiness-controller.namespace" . }} + labels: + {{- include "node-readiness-controller.labels" . | nindent 4 }} +spec: + podSelector: + matchLabels: + {{- include "node-readiness-controller.selectorLabels" . | nindent 6 }} + policyTypes: + - Ingress + - Egress + ingress: + # Kubelet liveness and readiness probes. + - ports: + - port: 8081 + protocol: TCP + {{- if .Values.webhook.enabled }} + # API server admission calls to the webhook server. + - ports: + - port: {{ .Values.webhook.port }} + protocol: TCP + {{- end }} + {{- if .Values.metrics.enabled }} + # Metrics scraping. + - ports: + - port: {{ .Values.metrics.service.targetPort }} + protocol: TCP + {{- end }} + {{- with .Values.networkPolicy.ingress }} + {{- toYaml . | nindent 4 }} + {{- end }} + egress: + # Kubernetes API server: watches, leases and status updates. + - ports: + - port: 443 + protocol: TCP + # Cluster DNS resolution. + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + {{- with .Values.networkPolicy.egress }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/node-readiness-controller/tests/networkpolicy_test.yaml b/charts/node-readiness-controller/tests/networkpolicy_test.yaml new file mode 100644 index 00000000..ce05b4c2 --- /dev/null +++ b/charts/node-readiness-controller/tests/networkpolicy_test.yaml @@ -0,0 +1,104 @@ +suite: Test Node Readiness Controller NetworkPolicy + +templates: + - networkpolicy.yaml + +release: + name: node-readiness-controller + +tests: + - it: does not create NetworkPolicy by default + asserts: + - hasDocuments: + count: 0 + + - it: creates NetworkPolicy when enabled + set: + networkPolicy: + enabled: true + asserts: + - isKind: + of: NetworkPolicy + - equal: + path: metadata.name + value: node-readiness-controller + - equal: + path: spec.podSelector.matchLabels + value: + app.kubernetes.io/name: node-readiness-controller + app.kubernetes.io/instance: node-readiness-controller + control-plane: controller-manager + - contains: + path: spec.policyTypes + content: Ingress + - contains: + path: spec.policyTypes + content: Egress + - equal: + path: spec.ingress[0].ports[0].port + value: 8081 + - equal: + path: spec.egress[0].ports[0].port + value: 443 + - equal: + path: spec.egress[1].ports[0].port + value: 53 + + - it: opens webhook and metrics ports when those servers are enabled + set: + networkPolicy: + enabled: true + webhook: + enabled: true + metrics: + enabled: true + asserts: + - isKind: + of: NetworkPolicy + - equal: + path: spec.ingress[1].ports[0].port + value: 9443 + - equal: + path: spec.ingress[2].ports[0].port + value: 8443 + + - it: keeps webhook and metrics ports closed when those servers are disabled + set: + networkPolicy: + enabled: true + asserts: + - isKind: + of: NetworkPolicy + - hasDocuments: + count: 1 + - isNull: + path: spec.ingress[1] + + - it: appends custom ingress and egress rules verbatim + set: + networkPolicy: + enabled: true + ingress: + - from: + - podSelector: + matchLabels: + monitoring: prometheus + ports: + - port: 9090 + protocol: TCP + egress: + - to: + - ipBlock: + cidr: 10.0.0.0/8 + ports: + - port: 9345 + protocol: TCP + asserts: + - isKind: + of: NetworkPolicy + - equal: + path: spec.ingress[1].from[0].podSelector.matchLabels.monitoring + value: prometheus + - equal: + path: spec.egress[2].to[0].ipBlock.cidr + value: 10.0.0.0/8 diff --git a/charts/node-readiness-controller/values.yaml b/charts/node-readiness-controller/values.yaml index 2a97244c..95a09892 100644 --- a/charts/node-readiness-controller/values.yaml +++ b/charts/node-readiness-controller/values.yaml @@ -37,6 +37,16 @@ podDisruptionBudget: minAvailable: 1 # maxUnavailable: 1 +# Optional NetworkPolicy isolating the controller pods. Disabled by default: +# enabling it restricts pod traffic to the generated rules below plus any +# extra ingress/egress entries, so review them against your cluster first. +networkPolicy: + enabled: false + # -- Extra ingress rules appended verbatim to the generated ones. + ingress: [] + # -- Extra egress rules appended verbatim to the generated ones. + egress: [] + priorityClassName: system-cluster-critical podAnnotations: