Skip to content

Commit b0e4aaf

Browse files
sabre1041sabre1041
authored
Added support for NetworkPolicies (#146)
Signed-off-by: Andrew Block <andy.block@gmail.com>
1 parent 640ce6c commit b0e4aaf

File tree

6 files changed

+141
-20
lines changed

6 files changed

+141
-20
lines changed

‎charts/backstage/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,4 @@ sources:
3838
# This is the chart version. This version number should be incremented each time you make changes
3939
# to the chart and its templates, including the app version.
4040
# Versions are expected to follow Semantic Versioning (https://semver.org/)
41-
version: 1.5.0
41+
version: 1.5.1

‎charts/backstage/README.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Backstage Helm Chart
33

44
[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/backstage)](https://artifacthub.io/packages/search?repo=backstage)
5-
![Version: 1.5.0](https://img.shields.io/badge/Version-1.5.0-informational?style=flat-square)
5+
![Version: 1.5.1](https://img.shields.io/badge/Version-1.5.1-informational?style=flat-square)
66
![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
77

88
A Helm chart for deploying a Backstage application
@@ -174,10 +174,12 @@ Kubernetes: `>= 1.19.0-0`
174174
| metrics.serviceMonitor.labels | Additional ServiceMonitor labels | object | `{}` |
175175
| metrics.serviceMonitor.path | ServiceMonitor endpoint path <br /> Note that the /metrics endpoint is NOT present in a freshly scaffolded Backstage app. To setup, follow the [Prometheus metrics tutorial](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/prometheus-metrics.md). | string | `"/metrics"` |
176176
| nameOverride | String to partially override common.names.fullname | string | `""` |
177-
| networkPolicy | Network policies <br /> Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ | object | `{"egressRules":{"customRules":[]},"enabled":false,"externalAccess":{"from":[]}}` |
178-
| networkPolicy.egressRules | Custom network policy rule | object | `{"customRules":[]}` |
179-
| networkPolicy.egressRules.customRules | Additional custom egress rules e.g: customRules: - to: - namespaceSelector: matchLabels: label: example | list | `[]` |
180-
| networkPolicy.enabled | networkPolicy.enabled Specifies whether a NetworkPolicy should be created | bool | `false` |
177+
| networkPolicy.egressRules.customRules | Additional custom egress rules | list | `[]` |
178+
| networkPolicy.egressRules.denyConnectionsToExternal | Deny external connections. Should not be enabled when working with an external database. | bool | `false` |
179+
| networkPolicy.enabled | Specifies whether a NetworkPolicy should be created | bool | `false` |
180+
| networkPolicy.ingressRules.customRules | Additional custom ingress rules | list | `[]` |
181+
| networkPolicy.ingressRules.namespaceSelector | Namespace selector label allowed to access the Backstage instance | object | `{}` |
182+
| networkPolicy.ingressRules.podSelector | Pod selector label allowed to access the Backstage instance | object | `{}` |
181183
| postgresql | PostgreSQL [chart configuration](https://github.com/bitnami/charts/blob/master/bitnami/postgresql/values.yaml) | object | See below |
182184
| postgresql.architecture | PostgreSQL architecture (`standalone` or `replication`) | string | `"standalone"` |
183185
| postgresql.auth | The authentication details of the Postgres database | object | `{"existingSecret":"","password":"","secretKeys":{"adminPasswordKey":"admin-password","replicationPasswordKey":"replication-password","userPasswordKey":"user-password"},"username":"bn_backstage"}` |

‎charts/backstage/templates/networkpolicy-egress.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.egressRules.denyConnectionsToExternal .Values.networkPolicy.egressRules.customRules) }}
2+
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ printf "%s-egress" (include "common.names.fullname" .) }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels: {{ include "common.labels.standard" . | nindent 4 }}
8+
app.kubernetes.io/component: backstage
9+
{{- if .Values.commonLabels }}
10+
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
11+
{{- end }}
12+
annotations:
13+
{{- if .Values.commonAnnotations }}
14+
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
15+
{{- end }}
16+
{{- if .Values.backstage.annotations }}
17+
{{- include "common.tplvalues.render" ( dict "value" .Values.backstage.annotations "context" $) | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
podSelector:
21+
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
22+
app.kubernetes.io/component: backstage
23+
policyTypes:
24+
- Egress
25+
egress:
26+
{{- if .Values.networkPolicy.egressRules.denyConnectionsToExternal }}
27+
- ports:
28+
- port: 53
29+
protocol: UDP
30+
- port: 53
31+
protocol: TCP
32+
- to:
33+
- namespaceSelector: {}
34+
{{- end }}
35+
{{- if .Values.networkPolicy.egressRules.customRules }}
36+
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }}
37+
{{- end }}
38+
{{- end }}

‎charts/backstage/templates/networkpolicy.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.ingressRules.namespaceSelector .Values.networkPolicy.ingressRules.podSelector .Values.networkPolicy.ingressRules.customRules) }}
2+
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ include "common.names.fullname" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels: {{ include "common.labels.standard" . | nindent 4 }}
8+
app.kubernetes.io/component: backstage
9+
{{- if .Values.commonLabels }}
10+
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
11+
{{- end }}
12+
annotations:
13+
{{- if .Values.commonAnnotations }}
14+
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
15+
{{- end }}
16+
{{- if .Values.backstage.annotations }}
17+
{{- include "common.tplvalues.render" ( dict "value" .Values.backstage.annotations "context" $) | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
podSelector:
21+
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
22+
app.kubernetes.io/component: backstage
23+
ingress:
24+
{{- if or .Values.networkPolicy.ingressRules.namespaceSelector .Values.networkPolicy.ingressRules.podSelector }}
25+
- from:
26+
{{- if .Values.networkPolicy.ingressRules.namespaceSelector }}
27+
- namespaceSelector:
28+
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.namespaceSelector "context" $) | nindent 14 }}
29+
{{- end }}
30+
{{- if .Values.networkPolicy.ingressRules.podSelector }}
31+
- podSelector:
32+
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.podSelector "context" $) | nindent 14 }}
33+
{{- end }}
34+
ports:
35+
- port: {{ .Values.backstage.containerPorts.backend }}
36+
{{- end }}
37+
{{- if .Values.networkPolicy.ingressRules.customRules }}
38+
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.customRules "context" $) | nindent 4 }}
39+
{{- end }}
40+
{{- end }}

‎charts/backstage/values.schema.json‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,6 @@
617617
},
618618
"networkPolicy": {
619619
"title": "Network policies",
620-
"description": "Not used in any template. Ref. https://kubernetes.io/docs/concepts/services-networking/network-policies/",
621620
"type": "object",
622621
"additionalProperties": false,
623622
"properties": {
@@ -626,9 +625,31 @@
626625
"type": "boolean",
627626
"default": false
628627
},
629-
"externalAccess": {
630-
"title": "Probably custom ingress rules for the network policy",
631-
"type": "object"
628+
"ingressRules": {
629+
"title": "Custom egress rules for the network policy",
630+
"type": "object",
631+
"additionalProperties": false,
632+
"properties": {
633+
"customRules": {
634+
"title": "",
635+
"type": "array",
636+
"items": {
637+
"$ref": "https://kubernetesjsonschema.dev/v1.8.7/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyIngressRule"
638+
}
639+
},
640+
"namespaceSelector": {
641+
"title": "Namespace Selector.",
642+
"description": "Selects Namespaces using cluster scoped-labels.",
643+
"$ref": "https://kubernetesjsonschema.dev/master/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
644+
"default": {}
645+
},
646+
"podSelector": {
647+
"title": "Pod Selector.",
648+
"description": "Selects selects Pods in this namespace.",
649+
"$ref": "https://kubernetesjsonschema.dev/master/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
650+
"default": {}
651+
}
652+
}
632653
},
633654
"egressRules": {
634655
"title": "Custom egress rules for the network policy",
@@ -641,6 +662,11 @@
641662
"items": {
642663
"$ref": "https://kubernetesjsonschema.dev/v1.8.7/_definitions.json#/definitions/io.k8s.api.networking.v1.NetworkPolicyEgressRule"
643664
}
665+
},
666+
"denyConnectionsToExternal": {
667+
"title": "Deny external connections. Should not be enabled when working with an external database.",
668+
"type": "boolean",
669+
"default": false
644670
}
645671
}
646672
}

‎charts/backstage/values.yaml‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -304,27 +304,42 @@ service:
304304
# -- Extra ports to expose in the Backstage service (normally used with the `sidecar` value)
305305
extraPorts: []
306306

307-
# -- Network policies
308-
# <br /> Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
307+
## @section NetworkPolicy parameters
308+
##
309309
networkPolicy:
310-
311-
# -- networkPolicy.enabled Specifies whether a NetworkPolicy should be created
310+
# -- Specifies whether a NetworkPolicy should be created
312311
enabled: false
313312

314-
externalAccess:
315-
from: []
313+
## Ingress Rules
314+
##
315+
ingressRules:
316+
317+
# -- Namespace selector label allowed to access the Backstage instance
318+
namespaceSelector: {}
319+
320+
# -- Pod selector label allowed to access the Backstage instance
321+
podSelector: {}
316322

317-
# -- Custom network policy rule
323+
# -- Additional custom ingress rules
324+
customRules: []
325+
# - to:
326+
# - namespaceSelector:
327+
# matchLabels:
328+
# label: example
329+
330+
## Egress Rules
331+
##
318332
egressRules:
319333

334+
# -- Deny external connections. Should not be enabled when working with an external database.
335+
denyConnectionsToExternal: false
336+
320337
# -- Additional custom egress rules
321-
# e.g:
322-
# customRules:
338+
customRules: []
323339
# - to:
324340
# - namespaceSelector:
325341
# matchLabels:
326342
# label: example
327-
customRules: []
328343

329344

330345
# -- PostgreSQL [chart configuration](https://github.com/bitnami/charts/blob/master/bitnami/postgresql/values.yaml)

0 commit comments

Comments
 (0)