diff --git a/charts/cryostat/README.md b/charts/cryostat/README.md index 11476b5..ec5e986 100644 --- a/charts/cryostat/README.md +++ b/charts/cryostat/README.md @@ -312,18 +312,19 @@ certificate issuance and rotation. ### Other Parameters -| Name | Description | Value | -| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -| `imagePullSecrets` | Image pull secrets to be used for the Cryostat deployment | `[]` | -| `nameOverride` | Overrides the name of this Chart | `""` | -| `fullnameOverride` | Overrides the fully qualified application name of `[release name]-[chart name]` | `""` | -| `rbac.create` | Specifies whether RBAC resources should be created | `true` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` | -| `podAnnotations` | Annotations to be applied to the various Pods | `{}` | -| `podSecurityContext` | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}` | -| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods | `true` | -| `nodeSelector` | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` | -| `tolerations` | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `[]` | -| `affinity` | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` | +| Name | Description | Value | +| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `imagePullSecrets` | Image pull secrets to be used for the Cryostat deployment | `[]` | +| `nameOverride` | Overrides the name of this Chart | `""` | +| `fullnameOverride` | Overrides the fully qualified application name of `[release name]-[chart name]` | `""` | +| `rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` | +| `podAnnotations` | Annotations to be applied to the various Pods | `{}` | +| `podSecurityContext` | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}` | +| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' inbound traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods. | `true` | +| `networkPolicy.egress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' outbound traffic is installed. This prevents Cryostat's component Pods from opening connections to unexpected destinations. The policy will allow Cryostat's Pods to communicate with each other, to the cluster API server, and to any target namespaces (core.discovery.kubernetes.namespaces). This is off by default since some cluster network plugins cause JDBC connectivity issues between Cryostat and its database when this policy is activated. When enabled, Cryostat users will not be able to define Custom Targets that are located outside of the target namespaces defined at installation time. | `false` | +| `nodeSelector` | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` | +| `tolerations` | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `[]` | +| `affinity` | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` | diff --git a/charts/cryostat/templates/networkpolicy_egress.yaml b/charts/cryostat/templates/networkpolicy_egress.yaml new file mode 100644 index 0000000..ba914d9 --- /dev/null +++ b/charts/cryostat/templates/networkpolicy_egress.yaml @@ -0,0 +1,41 @@ +{{- if ((.Values.networkPolicy.egress).enabled) }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ .Release.Name }}-internal-egress + namespace: {{ .Release.Namespace }} +spec: + policyTypes: + - Egress + podSelector: + matchLabels: + {{- include "cryostat.selectorLabels" $ | nindent 6 }} + app.kubernetes.io/component: cryostat + egress: + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - to: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - {{ .Release.Namespace }} + {{- range .Values.core.discovery.kubernetes.namespaces }} + - {{ . }} + {{- end }} +{{- if .Values.authentication.openshift.enabled }} +{{- $kubernetesEndpoint := lookup "v1" "Endpoints" "default" "kubernetes" }} +{{- $kubernetesAddress := (first $kubernetesEndpoint.subsets).addresses }} +{{- $kubernetesIP := (first $kubernetesAddress).ip }} + - to: + - ipBlock: + cidr: {{ $kubernetesIP }}/32 + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: openshift +{{- end }} +{{- end }} diff --git a/charts/cryostat/tests/networkpolicy_egress_test.yaml b/charts/cryostat/tests/networkpolicy_egress_test.yaml new file mode 100644 index 0000000..a820b61 --- /dev/null +++ b/charts/cryostat/tests/networkpolicy_egress_test.yaml @@ -0,0 +1,69 @@ +suite: test networkpolicy_egress.yaml +templates: + - networkpolicy_egress.yaml + +tests: + - it: should be disabled by default + asserts: + - hasDocuments: + count: 0 + + - it: should create an internal-access policy + set: + networkPolicy.egress.enabled: true + asserts: + - equal: + path: kind + value: NetworkPolicy + - equal: + path: metadata.name + value: RELEASE-NAME-internal-egress + - equal: + path: metadata.namespace + value: NAMESPACE + - equal: + path: spec.podSelector + value: + matchLabels: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: cryostat + app.kubernetes.io/component: cryostat + app.kubernetes.io/part-of: cryostat + - equal: + path: spec.egress + value: + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - to: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - NAMESPACE + + - it: should allow additional egress to target namespaces + set: + networkPolicy.egress.enabled: true + core.discovery.kubernetes.namespaces: + - apps1 + - apps2 + asserts: + - equal: + path: spec.egress + value: + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - to: + - namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - NAMESPACE + - apps1 + - apps2 diff --git a/charts/cryostat/values.schema.json b/charts/cryostat/values.schema.json index ba76744..889f623 100644 --- a/charts/cryostat/values.schema.json +++ b/charts/cryostat/values.schema.json @@ -1540,10 +1540,20 @@ "properties": { "enabled": { "type": "boolean", - "description": "whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods", + "description": "whether a NetworkPolicy for restricting Cryostat component Pods' inbound traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods.", "default": true } } + }, + "egress": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "description": "whether a NetworkPolicy for restricting Cryostat component Pods' outbound traffic is installed. This prevents Cryostat's component Pods from opening connections to unexpected destinations. The policy will allow Cryostat's Pods to communicate with each other, to the cluster API server, and to any target namespaces (core.discovery.kubernetes.namespaces). This is off by default since some cluster network plugins cause JDBC connectivity issues between Cryostat and its database when this policy is activated. When enabled, Cryostat users will not be able to define Custom Targets that are located outside of the target namespaces defined at installation time.", + "default": false + } + } } } }, diff --git a/charts/cryostat/values.yaml b/charts/cryostat/values.yaml index 4b7e4bb..4326f02 100644 --- a/charts/cryostat/values.yaml +++ b/charts/cryostat/values.yaml @@ -599,8 +599,11 @@ podSecurityContext: networkPolicy: ingress: - ## @param networkPolicy.ingress.enabled whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods + ## @param networkPolicy.ingress.enabled whether a NetworkPolicy for restricting Cryostat component Pods' inbound traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods. enabled: true + egress: + ## @param networkPolicy.egress.enabled whether a NetworkPolicy for restricting Cryostat component Pods' outbound traffic is installed. This prevents Cryostat's component Pods from opening connections to unexpected destinations. The policy will allow Cryostat's Pods to communicate with each other, to the cluster API server, and to any target namespaces (core.discovery.kubernetes.namespaces). This is off by default since some cluster network plugins cause JDBC connectivity issues between Cryostat and its database when this policy is activated. When enabled, Cryostat users will not be able to define Custom Targets that are located outside of the target namespaces defined at installation time. + enabled: false ## @param nodeSelector [object] default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) nodeSelector: {}