Skip to content

feat(network): enable optional egress network policy #209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

feat(network): enable optional egress network policy #209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b9a8633
feat(network): enable optional egress network policy
andrewazores Nov 13, 2024
472ebb2
fixup! feat(network): enable optional egress network policy
andrewazores Jun 13, 2025
4964482
refactor, remove 'default' namespace egress
andrewazores Aug 28, 2025
f787604
fixup! feat(network): enable optional egress network policy
andrewazores Oct 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 16 additions & 15 deletions charts/cryostat/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,18 +312,19 @@ certificate issuance and rotation.

### Other Parameters

| Name | Description | Value |
| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| `imagePullSecrets` | Image pull secrets to be used for the Cryostat deployment | `[]` |
| `nameOverride` | Overrides the name of this Chart | `""` |
| `fullnameOverride` | Overrides the fully qualified application name of `[release name]-[chart name]` | `""` |
| `rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` |
| `podAnnotations` | Annotations to be applied to the various Pods | `{}` |
| `podSecurityContext` | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}` |
| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods | `true` |
| `nodeSelector` | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` |
| `tolerations` | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `[]` |
| `affinity` | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` |
| Name | Description | Value |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| `imagePullSecrets` | Image pull secrets to be used for the Cryostat deployment | `[]` |
| `nameOverride` | Overrides the name of this Chart | `""` |
| `fullnameOverride` | Overrides the fully qualified application name of `[release name]-[chart name]` | `""` |
| `rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template | `""` |
| `podAnnotations` | Annotations to be applied to the various Pods | `{}` |
| `podSecurityContext` | Security Context for the Cryostat Pod. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [PodSecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) | `{}` |
| `networkPolicy.ingress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' inbound traffic is installed. This prevents other Pods from sending unwanted traffic to Cryostat's Pods. Traffic should flow via the Service (or Route, or other Ingress) only, not by directly targeting Pods. | `true` |
| `networkPolicy.egress.enabled` | whether a NetworkPolicy for restricting Cryostat component Pods' outbound traffic is installed. This prevents Cryostat's component Pods from opening connections to unexpected destinations. The policy will allow Cryostat's Pods to communicate with each other, to the cluster API server, and to any target namespaces (core.discovery.kubernetes.namespaces). This is off by default since some cluster network plugins cause JDBC connectivity issues between Cryostat and its database when this policy is activated. When enabled, Cryostat users will not be able to define Custom Targets that are located outside of the target namespaces defined at installation time. | `false` |
| `nodeSelector` | default Node Selector for the various Pods. Any Pod which does not have an individual nodeSelector setting will default to this. See: [NodeSelector](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` |
| `tolerations` | default Tolerations for the various Pods. See: [Tolerations](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `[]` |
| `affinity` | default Affinity for the various Pods. See: [Affinity](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) | `{}` |
41 changes: 41 additions & 0 deletions charts/cryostat/templates/networkpolicy_egress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{{- if ((.Values.networkPolicy.egress).enabled) }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ .Release.Name }}-internal-egress
namespace: {{ .Release.Namespace }}
spec:
policyTypes:
- Egress
podSelector:
matchLabels:
{{- include "cryostat.selectorLabels" $ | nindent 6 }}
app.kubernetes.io/component: cryostat
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- to:
- namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values:
- {{ .Release.Namespace }}
{{- range .Values.core.discovery.kubernetes.namespaces }}
- {{ . }}
{{- end }}
{{- if .Values.authentication.openshift.enabled }}
{{- $kubernetesEndpoint := lookup "v1" "Endpoints" "default" "kubernetes" }}
{{- $kubernetesAddress := (first $kubernetesEndpoint.subsets).addresses }}
{{- $kubernetesIP := (first $kubernetesAddress).ip }}
- to:
- ipBlock:
cidr: {{ $kubernetesIP }}/32
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift
{{- end }}
{{- end }}
69 changes: 69 additions & 0 deletions charts/cryostat/tests/networkpolicy_egress_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
suite: test networkpolicy_egress.yaml
templates:
- networkpolicy_egress.yaml

tests:
- it: should be disabled by default
asserts:
- hasDocuments:
count: 0

- it: should create an internal-access policy
set:
networkPolicy.egress.enabled: true
asserts:
- equal:
path: kind
value: NetworkPolicy
- equal:
path: metadata.name
value: RELEASE-NAME-internal-egress
- equal:
path: metadata.namespace
value: NAMESPACE
- equal:
path: spec.podSelector
value:
matchLabels:
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/name: cryostat
app.kubernetes.io/component: cryostat
app.kubernetes.io/part-of: cryostat
- equal:
path: spec.egress
value:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- to:
- namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values:
- NAMESPACE

- it: should allow additional egress to target namespaces
set:
networkPolicy.egress.enabled: true
core.discovery.kubernetes.namespaces:
- apps1
- apps2
asserts:
- equal:
path: spec.egress
value:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- to:
- namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values:
- NAMESPACE
- apps1
- apps2
Loading