feat(chart): add optional NetworkPolicy for high availability

charts/node-readiness-controller/README.md

@@ -63,6 +63,9 @@ The following table lists the configurable parameters of the _node-readiness-con
 | `podDisruptionBudget.enabled`            | Enable PodDisruptionBudget for the controller                                                                                   | `false`                                                           |
 | `podDisruptionBudget.minAvailable`       | Minimum number of available controller pods                                                                                     | `1`                                                               |
 | `podDisruptionBudget.maxUnavailable`     | Maximum number of unavailable controller pods                                                                                   | `nil`                                                             |
+| `networkPolicy.enabled`                | Enable a NetworkPolicy isolating the controller pods (review the generated rules for your cluster first)                        | `false`                                                           |
+| `networkPolicy.ingress`                | Extra ingress rules appended verbatim to the generated ones                                                                     | `[]`                                                              |
+| `networkPolicy.egress`                 | Extra egress rules appended verbatim to the generated ones                                                                      | `[]`                                                              |
 | `controller.kubeAPIQPS`                  | Maximum QPS to the Kubernetes API server. `-1` means no limit.                                                                  | `-1`                                                              |
 | `controller.kubeAPIBurst`                | Maximum burst for throttled API server requests. `-1` means no limit.                                                           | `-1`                                                              |
 | `controller.nodeConcurrentReconciles`    | Maximum number of Node objects reconciled concurrently. Raise on large clusters.                                                | `1`                                                               |

charts/node-readiness-controller/templates/networkpolicy.yaml

@@ -0,0 +1,50 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "node-readiness-controller.fullname" . }}
+  namespace: {{ include "node-readiness-controller.namespace" . }}
+  labels:
+    {{- include "node-readiness-controller.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "node-readiness-controller.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Kubelet liveness and readiness probes.
+    - ports:
+        - port: 8081
+          protocol: TCP
+    {{- if .Values.webhook.enabled }}
+    # API server admission calls to the webhook server.
+    - ports:
+        - port: {{ .Values.webhook.port }}
+          protocol: TCP
+    {{- end }}
+    {{- if .Values.metrics.enabled }}
+    # Metrics scraping.
+    - ports:
+        - port: {{ .Values.metrics.service.targetPort }}
+          protocol: TCP
+    {{- end }}
+    {{- with .Values.networkPolicy.ingress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  egress:
+    # Kubernetes API server: watches, leases and status updates.
+    - ports:
+        - port: 443
+          protocol: TCP
+    # Cluster DNS resolution.
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- with .Values.networkPolicy.egress }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- end }}

charts/node-readiness-controller/tests/networkpolicy_test.yaml

@@ -0,0 +1,104 @@
+suite: Test Node Readiness Controller NetworkPolicy
+
+templates:
+  - networkpolicy.yaml
+
+release:
+  name: node-readiness-controller
+
+tests:
+  - it: does not create NetworkPolicy by default
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: creates NetworkPolicy when enabled
+    set:
+      networkPolicy:
+        enabled: true
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - equal:
+          path: metadata.name
+          value: node-readiness-controller
+      - equal:
+          path: spec.podSelector.matchLabels
+          value:
+            app.kubernetes.io/name: node-readiness-controller
+            app.kubernetes.io/instance: node-readiness-controller
+            control-plane: controller-manager
+      - contains:
+          path: spec.policyTypes
+          content: Ingress
+      - contains:
+          path: spec.policyTypes
+          content: Egress
+      - equal:
+          path: spec.ingress[0].ports[0].port
+          value: 8081
+      - equal:
+          path: spec.egress[0].ports[0].port
+          value: 443
+      - equal:
+          path: spec.egress[1].ports[0].port
+          value: 53
+
+  - it: opens webhook and metrics ports when those servers are enabled
+    set:
+      networkPolicy:
+        enabled: true
+      webhook:
+        enabled: true
+      metrics:
+        enabled: true
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - equal:
+          path: spec.ingress[1].ports[0].port
+          value: 9443
+      - equal:
+          path: spec.ingress[2].ports[0].port
+          value: 8443
+
+  - it: keeps webhook and metrics ports closed when those servers are disabled
+    set:
+      networkPolicy:
+        enabled: true
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - hasDocuments:
+          count: 1
+      - isNull:
+          path: spec.ingress[1]
+
+  - it: appends custom ingress and egress rules verbatim
+    set:
+      networkPolicy:
+        enabled: true
+        ingress:
+          - from:
+              - podSelector:
+                  matchLabels:
+                    monitoring: prometheus
+            ports:
+              - port: 9090
+                protocol: TCP
+        egress:
+          - to:
+              - ipBlock:
+                  cidr: 10.0.0.0/8
+            ports:
+              - port: 9345
+                protocol: TCP
+    asserts:
+      - isKind:
+          of: NetworkPolicy
+      - equal:
+          path: spec.ingress[1].from[0].podSelector.matchLabels.monitoring
+          value: prometheus
+      - equal:
+          path: spec.egress[2].to[0].ipBlock.cidr
+          value: 10.0.0.0/8

charts/node-readiness-controller/values.yaml

@@ -37,6 +37,16 @@ podDisruptionBudget:
   minAvailable: 1
   # maxUnavailable: 1
 
+# Optional NetworkPolicy isolating the controller pods. Disabled by default:
+# enabling it restricts pod traffic to the generated rules below plus any
+# extra ingress/egress entries, so review them against your cluster first.
+networkPolicy:
+  enabled: false
+  # -- Extra ingress rules appended verbatim to the generated ones.
+  ingress: []
+  # -- Extra egress rules appended verbatim to the generated ones.
+  egress: []
+
 priorityClassName: system-cluster-critical
 
 podAnnotations: