Merge "Apply network policy to all services"

aodh/templates/network_policy.yaml

@@ -0,0 +1,18 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.manifests.network_policy -}}
+{{- $opts := dict "envAll" . "name" "application" "label" "aodh" -}}
+{{ $opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
+{{- end -}}

aodh/values.yaml

@@ -693,6 +693,13 @@ endpoints:
       metrics:
         default: 24220
 
+network_policy:
+  aodh:
+    ingress:
+      - {}
+    egress:
+      - {}
+
 manifests:
   configmap_bin: true
   configmap_etc: true
@@ -711,6 +718,7 @@ manifests:
   job_ks_endpoints: true
   job_ks_service: true
   job_ks_user: true
+  network_policy: false
   pdb_api: true
   pod_aodh_test: true
   secret_db: true

ceilometer/values.yaml

@@ -2101,6 +2101,8 @@ network_policy:
   ceilometer:
     ingress:
       - {}
+    egress:
+      - {}
 
 manifests:
   configmap_bin: true

congress/values.yaml

@@ -350,6 +350,8 @@ network_policy:
   congress:
     ingress:
       - {}
+    egress:
+      - {}
 
 conf:
   congress:

ironic/values.yaml

@@ -679,6 +679,8 @@ network_policy:
   ironic:
     ingress:
       - {}
+    egress:
+      - {}
 
 manifests:
   configmap_bin: true

magnum/values.yaml

@@ -622,24 +622,9 @@ pod:
 network_policy:
   magnum:
     ingress:
-      - from:
+      - {}
-        - podSelector:
+    egress:
-            matchLabels:
+      - {}
-              application: magnum
-        - podSelector:
-            matchLabels:
-              application: horizon
-        - podSelector:
-            matchLabels:
-              application: ingress
-        - podSelector:
-            matchLabels:
-              application: heat
-        ports:
-        - protocol: TCP
-          port: 80
-        - protocol: TCP
-          port: 9511
 
 manifests:
   configmap_bin: true

mistral/values.yaml

@@ -701,24 +701,9 @@ pod:
 network_policy:
   mistral:
     ingress:
-      - from:
+      - {}
-        - podSelector:
+    egress:
-            matchLabels:
+      - {}
-              application: mistral
-        - podSelector:
-            matchLabels:
-              application: horizon
-        - podSelector:
-            matchLabels:
-              application: ingress
-        - podSelector:
-            matchLabels:
-              application: heat
-        ports:
-        - protocol: TCP
-          port: 80
-        - protocol: TCP
-          port: 8989
 
 manifests:
   configmap_bin: true

panko/templates/network_policy.yaml

@@ -0,0 +1,18 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.manifests.network_policy -}}
+{{- $opts := dict "envAll" . "name" "application" "label" "panko" -}}
+{{ $opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
+{{- end -}}

panko/values.yaml

@@ -454,6 +454,13 @@ endpoints:
       metrics:
         default: 24220
 
+network_policy:
+  panko:
+    ingress:
+      - {}
+    egress:
+      - {}
+
 pod:
   security_context:
     panko:
@@ -606,6 +613,7 @@ manifests:
   job_ks_endpoints: true
   job_ks_service: true
   job_ks_user: true
+  network_policy: false
   pdb_api: true
   pod_rally_test: true
   secret_db: true

senlin/values.yaml

@@ -658,6 +658,8 @@ network_policy:
   senlin:
     ingress:
       - {}
+    egress:
+      - {}
 
 manifests:
   configmap_bin: true