Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(guacamole-chart): Add NetworkPolicy manifests to defend pods #10

Draft
wants to merge 45 commits into
base: main
Choose a base branch
from
Draft

feat(guacamole-chart): Add NetworkPolicy manifests to defend pods #10

Show file tree
Hide file tree
Changes from 43 commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
3d1153c
feat: change fields
rdash99 Mar 14, 2024
14bf30d
feat: create guacd-network.yaml
rdash99 Mar 14, 2024
73322d6
feat: create database-network.yaml
rdash99 Mar 14, 2024
69a18f5
feat: create controller-network.yaml policy file
rdash99 Mar 21, 2024
38ce50a
feat: update database-network.yaml
rdash99 Mar 21, 2024
986de65
feat: update database-network.yaml to block egress
rdash99 Mar 21, 2024
ac44eaf
feat: update controller-network.yaml to block ingress
rdash99 Mar 21, 2024
574eba3
feat: update controller-network.yaml to block ingress
rdash99 Mar 21, 2024
573b5e4
feat: update database-network.yaml to block egress
rdash99 Mar 21, 2024
24cacb2
feat: update guacd-network.yaml to allow ingress from the web pod
rdash99 Mar 21, 2024
eb13a32
feat: create web-network.yaml
rdash99 Mar 21, 2024
1a79960
fix: select correct component
rdash99 Mar 21, 2024
20adf16
fix: select correct component
rdash99 Mar 21, 2024
ef9d5c4
Revert "feat: change fields"
rdash99 Apr 4, 2024
ebff694
fix: allow ingress from controller to database
rdash99 Apr 4, 2024
af7b0a7
fix: allow ingress from controller to web
rdash99 Apr 4, 2024
23845dd
test: allow egress from controller to database
rdash99 Apr 4, 2024
bc90608
test: open all bar the controller
rdash99 Apr 4, 2024
2b21db6
test: open all bar the controller
rdash99 Apr 4, 2024
2b5c363
test: link database and controller
rdash99 Apr 4, 2024
a7773c4
test: link web and controller
rdash99 Apr 4, 2024
50e6865
test: link web and database
rdash99 Apr 4, 2024
d57f33d
test: link web and controller egress
rdash99 Apr 4, 2024
a1bf7f2
Revert "test: link web and controller egress"
rdash99 Apr 4, 2024
58d9b64
Revert "test: link web and database"
rdash99 Apr 4, 2024
1acbe65
test: link web and guacd
rdash99 Apr 4, 2024
5b00717
Merge branch 'main' into feat/add-networkpolicy-manifests-to-defend-pods
rdash99 Apr 4, 2024
5a310bb
test: web egress to controller
rdash99 Apr 4, 2024
542e46f
fix: test pr linting rules
JossWhittle Apr 4, 2024
2fac5ba
fix: controller ingress
rdash99 Apr 4, 2024
5dbd830
Merge remote-tracking branch 'origin/feat/add-networkpolicy-manifests…
rdash99 Apr 4, 2024
883f2c1
Revert "fix: controller ingress"
rdash99 Apr 4, 2024
401dba8
Revert "test: web egress to controller"
rdash99 Apr 4, 2024
51413bc
Revert "test: link web and guacd"
rdash99 Apr 4, 2024
79b261a
test: link web and database
rdash99 Apr 4, 2024
00e6bc3
test: enable all remaining policies
rdash99 Apr 4, 2024
1ce763f
test: open db pod completely
rdash99 Apr 4, 2024
423da29
test: open db pod egress
rdash99 Apr 4, 2024
ece5427
fix: open db pod egress
rdash99 Apr 4, 2024
7fc3a9f
Merge branch 'main' into feat/add-networkpolicy-manifests-to-defend-pods
JossWhittle Apr 4, 2024
8723cb3
fix: open web pod egress
rdash99 Apr 4, 2024
320a099
test: lock down database pod
rdash99 Apr 4, 2024
2bedf08
fix: lock down database pod
rdash99 Apr 4, 2024
ce67683
refactor: Cleanup commented templates
rdash99 Apr 11, 2024
821302e
refactor: Drop the -network suffix on names
rdash99 Apr 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions charts/guacamole/templates/controller/controller-network.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: {{ include "guacamole.fullname" . }}-controller-network
labels:
app: {{ include "guacamole.labels.app" . }}
chart: {{ include "guacamole.labels.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
podSelector:
matchLabels:
cnpg.io/cluster: {{ include "guacamole.fullname" . }}-controller
policyTypes:
- Ingress
- Egress

egress:
- to:
- podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: web
release: {{ .Release.Name }}
- podSelector:
matchLabels:
cnpg.io/cluster: {{ include "guacamole.fullname" . }}-database
{{/* - podSelector:*/}}
{{/* matchLabels:*/}}
{{/* app: {{ include "guacamole.labels.app" . }}*/}}
{{/* component: controller*/}}
{{/* release: {{ .Release.Name }}*/}}
rdash99 marked this conversation as resolved.
Show resolved Hide resolved
34 changes: 34 additions & 0 deletions charts/guacamole/templates/database/database-network.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: {{ include "guacamole.fullname" . }}-database-network
rdash99 marked this conversation as resolved.
Show resolved Hide resolved
labels:
app: {{ include "guacamole.labels.app" . }}
chart: {{ include "guacamole.labels.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: database
release: {{ .Release.Name }}
policyTypes:
- Ingress
- Egress

ingress:
- from:
- podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: web
release: {{ .Release.Name }}
- podSelector:
matchLabels:
cnpg.io/cluster: {{ include "guacamole.fullname" . }}-database
- podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: controller
release: {{ .Release.Name }}
29 changes: 29 additions & 0 deletions charts/guacamole/templates/guacd/guacd-network.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: {{ include "guacamole.fullname" . }}-guacd-network
rdash99 marked this conversation as resolved.
Show resolved Hide resolved
labels:
app: {{ include "guacamole.labels.app" . }}
chart: {{ include "guacamole.labels.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
podSelector:
matchLabels:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: guacd
release: {{ .Release.Name }}
policyTypes:
- Ingress
- Egress

ingress:
- from:
- podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: web
release: {{ .Release.Name }}
egress:
- {}
37 changes: 37 additions & 0 deletions charts/guacamole/templates/web/web-network.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: {{ include "guacamole.fullname" . }}-web-network
rdash99 marked this conversation as resolved.
Show resolved Hide resolved
labels:
app: {{ include "guacamole.labels.app" . }}
chart: {{ include "guacamole.labels.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: web
release: {{ .Release.Name }}
policyTypes:
- Ingress
- Egress

ingress:
- from:
- podSelector:
matchLabels:
app: {{ include "guacamole.labels.app" . }}
component: controller
release: {{ .Release.Name }}
egress:
- {}
{{/* - to:*/}}
{{/* - podSelector:*/}}
{{/* matchLabels:*/}}
{{/* cnpg.io/cluster: {{ include "guacamole.fullname" . }}-database*/}}
{{/* - podSelector:*/}}
{{/* matchLabels:*/}}
{{/* app: {{ include "guacamole.labels.app" . }}*/}}
{{/* component: guacd*/}}
{{/* release: {{ .Release.Name }}*/}}
rdash99 marked this conversation as resolved.
Show resolved Hide resolved
Loading