Skip to content

Commit 180bd72

Browse files
stremovskystremovsky
committed
add network policy
1 parent ed870d7 commit 180bd72

2 files changed

Lines changed: 241 additions & 0 deletions

File tree

‎helm/databunkerpro/templates/networkpolicy.yaml‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ include "databunkerpro.fullname" . }}-network-policy
6+
labels:
7+
{{- include "databunkerpro.labels" . | nindent 4 }}
8+
spec:
9+
podSelector:
10+
matchLabels:
11+
{{- include "databunkerpro.selectorLabels" . | nindent 6 }}
12+
app.kubernetes.io/component: databunkerpro
13+
policyTypes:
14+
- Ingress
15+
- Egress
16+
ingress:
17+
# Allow ingress from ingress controller
18+
{{- if .Values.ingress.enabled }}
19+
- from:
20+
- namespaceSelector:
21+
matchLabels:
22+
name: {{ .Values.networkPolicy.ingressNamespace | default "ingress-nginx" }}
23+
ports:
24+
- protocol: TCP
25+
port: {{ .Values.config.databunker.port }}
26+
{{- end }}
27+
# Allow ingress from other pods in the same namespace (for internal communication)
28+
- from:
29+
- namespaceSelector:
30+
matchLabels:
31+
name: {{ .Release.Namespace }}
32+
ports:
33+
- protocol: TCP
34+
port: {{ .Values.config.databunker.port }}
35+
egress:
36+
# Allow DNS resolution
37+
- to: []
38+
ports:
39+
- protocol: UDP
40+
port: 53
41+
- protocol: TCP
42+
port: 53
43+
# Allow HTTPS for external API calls
44+
- to: []
45+
ports:
46+
- protocol: TCP
47+
port: 443
48+
# Allow HTTP for external API calls (if needed)
49+
- to: []
50+
ports:
51+
- protocol: TCP
52+
port: 80
53+
# Allow SMTP for email notifications
54+
- to: []
55+
ports:
56+
- protocol: TCP
57+
port: 587
58+
- protocol: TCP
59+
port: 465
60+
- protocol: TCP
61+
port: 25
62+
# Allow PostgreSQL connection (internal)
63+
{{- if and (not .Values.database.external) (eq .Values.database.type "postgresql") }}
64+
- to:
65+
- podSelector:
66+
matchLabels:
67+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
68+
app.kubernetes.io/component: postgresql
69+
ports:
70+
- protocol: TCP
71+
port: 5432
72+
{{- end }}
73+
# Allow MySQL connection (internal)
74+
{{- if and (not .Values.database.external) (eq .Values.database.type "mysql") }}
75+
- to:
76+
- podSelector:
77+
matchLabels:
78+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
79+
app.kubernetes.io/component: mysql
80+
ports:
81+
- protocol: TCP
82+
port: 3306
83+
{{- end }}
84+
# Allow Redis connection (internal)
85+
{{- if and .Values.redis.enabled (not .Values.redis.external) }}
86+
- to:
87+
- podSelector:
88+
matchLabels:
89+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
90+
app.kubernetes.io/component: redis
91+
ports:
92+
- protocol: TCP
93+
port: 6379
94+
{{- end }}
95+
# Allow external database connections (if configured)
96+
{{- if .Values.database.external }}
97+
- to: []
98+
ports:
99+
- protocol: TCP
100+
port: {{ .Values.database.externalConfig.port | default (ternary 5432 (ternary 3306 5432 (eq .Values.database.type "mysql"))) }}
101+
{{- end }}
102+
# Allow external Redis connections (if configured)
103+
{{- if and .Values.redis.enabled .Values.redis.external }}
104+
- to: []
105+
ports:
106+
- protocol: TCP
107+
port: {{ .Values.redis.externalConfig.port | default 6379 }}
108+
{{- end }}
109+
---
110+
# Network policy for PostgreSQL (if running internally)
111+
{{- if and (not .Values.database.external) (eq .Values.database.type "postgresql") }}
112+
apiVersion: networking.k8s.io/v1
113+
kind: NetworkPolicy
114+
metadata:
115+
name: {{ include "databunkerpro.fullname" . }}-postgresql-network-policy
116+
labels:
117+
{{- include "databunkerpro.labels" . | nindent 4 }}
118+
app.kubernetes.io/component: postgresql
119+
spec:
120+
podSelector:
121+
matchLabels:
122+
{{- include "databunkerpro.selectorLabels" . | nindent 6 }}
123+
app.kubernetes.io/component: postgresql
124+
policyTypes:
125+
- Ingress
126+
- Egress
127+
ingress:
128+
# Allow connections from DataBunker pods
129+
- from:
130+
- podSelector:
131+
matchLabels:
132+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
133+
app.kubernetes.io/component: databunkerpro
134+
ports:
135+
- protocol: TCP
136+
port: 5432
137+
egress:
138+
# Allow DNS resolution
139+
- to: []
140+
ports:
141+
- protocol: UDP
142+
port: 53
143+
- protocol: TCP
144+
port: 53
145+
# Allow PostgreSQL to make external connections if needed
146+
- to: []
147+
ports:
148+
- protocol: TCP
149+
port: 443
150+
{{- end }}
151+
---
152+
# Network policy for MySQL (if running internally)
153+
{{- if and (not .Values.database.external) (eq .Values.database.type "mysql") }}
154+
apiVersion: networking.k8s.io/v1
155+
kind: NetworkPolicy
156+
metadata:
157+
name: {{ include "databunkerpro.fullname" . }}-mysql-network-policy
158+
labels:
159+
{{- include "databunkerpro.labels" . | nindent 4 }}
160+
app.kubernetes.io/component: mysql
161+
spec:
162+
podSelector:
163+
matchLabels:
164+
{{- include "databunkerpro.selectorLabels" . | nindent 6 }}
165+
app.kubernetes.io/component: mysql
166+
policyTypes:
167+
- Ingress
168+
- Egress
169+
ingress:
170+
# Allow connections from DataBunker pods
171+
- from:
172+
- podSelector:
173+
matchLabels:
174+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
175+
app.kubernetes.io/component: databunkerpro
176+
ports:
177+
- protocol: TCP
178+
port: 3306
179+
egress:
180+
# Allow DNS resolution
181+
- to: []
182+
ports:
183+
- protocol: UDP
184+
port: 53
185+
- protocol: TCP
186+
port: 53
187+
# Allow MySQL to make external connections if needed
188+
- to: []
189+
ports:
190+
- protocol: TCP
191+
port: 443
192+
{{- end }}
193+
---
194+
# Network policy for Redis (if running internally)
195+
{{- if and .Values.redis.enabled (not .Values.redis.external) }}
196+
apiVersion: networking.k8s.io/v1
197+
kind: NetworkPolicy
198+
metadata:
199+
name: {{ include "databunkerpro.fullname" . }}-redis-network-policy
200+
labels:
201+
{{- include "databunkerpro.labels" . | nindent 4 }}
202+
app.kubernetes.io/component: redis
203+
spec:
204+
podSelector:
205+
matchLabels:
206+
{{- include "databunkerpro.selectorLabels" . | nindent 6 }}
207+
app.kubernetes.io/component: redis
208+
policyTypes:
209+
- Ingress
210+
- Egress
211+
ingress:
212+
# Allow connections from DataBunker pods
213+
- from:
214+
- podSelector:
215+
matchLabels:
216+
{{- include "databunkerpro.selectorLabels" . | nindent 12 }}
217+
app.kubernetes.io/component: databunkerpro
218+
ports:
219+
- protocol: TCP
220+
port: 6379
221+
egress:
222+
# Allow DNS resolution
223+
- to: []
224+
ports:
225+
- protocol: UDP
226+
port: 53
227+
- protocol: TCP
228+
port: 53
229+
# Allow Redis to make external connections if needed
230+
- to: []
231+
ports:
232+
- protocol: TCP
233+
port: 443
234+
{{- end }}
235+
{{- end }}

‎helm/databunkerpro/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,12 @@ redis:
210210
password: "" # Will be auto-generated if not set
211211
username: "default"
212212

213+
# Network Policy configuration
214+
networkPolicy:
215+
enabled: false # Set to true to enable network policies
216+
# Namespace where ingress controller is running (for ingress rules)
217+
ingressNamespace: "ingress-nginx" # Change this to match your ingress controller namespace
218+
213219
# DatabunkerPro configuration
214220
config:
215221
# Wrapping key for encryption

0 commit comments

Comments
 (0)