Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Network policy #9077

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Network policy #9077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9a5b691
fix(network-policy): remove port 80 from UI policy
lahwaacz Jul 24, 2024
71733e7
fix(network-policy): restrict UI to port 8000 for all ingress types
lahwaacz Jul 24, 2024
4d8476f
fix(network-policy): add egress policy for UI
lahwaacz Jul 24, 2024
b438a5b
chore: remove network policies from examples
lahwaacz Jul 24, 2024
eed7f33
fix(network-policy): refactor longhorn-manager policy and add speicif…
lahwaacz Jul 24, 2024
9538a7b
fix(network-policy): refactor instance-manager policy and add speicif…
lahwaacz Jul 28, 2024
cfb9402
fix(network-policy): adjust backing-image-data-source and backing-ima…
lahwaacz Jul 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 18 additions & 14 deletions chart/templates/network-policies/backing-image-data-source-network-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,23 @@ spec:
matchLabels:
longhorn.io/component: backing-image-data-source
policyTypes:
- Ingress
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: longhorn-manager
- podSelector:
matchLabels:
longhorn.io/component: instance-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-data-source
- from:
- podSelector:
matchLabels:
app: longhorn-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
ports:
- protocol: TCP
port: 8000
- from:
- podSelector:
matchLabels:
longhorn.io/component: instance-manager
ports:
- protocol: TCP
port: 8002
{{- end }}
61 changes: 47 additions & 14 deletions chart/templates/network-policies/backing-image-manager-network-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,52 @@ spec:
matchLabels:
longhorn.io/component: backing-image-manager
policyTypes:
- Ingress
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: longhorn-manager
- podSelector:
matchLabels:
longhorn.io/component: instance-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-data-source
- from:
- podSelector:
matchLabels:
app: longhorn-manager
ports:
- protocol: TCP
port: 8000
- from:
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
{{- /* NOTE: this should allow only the port range 30001-31000 but many CNIs do not support endPort :-(
ports:
- protocol: TCP
port: 30001
endPort: 31000
*/}}
egress:
- to:
- podSelector:
matchLabels:
longhorn.io/component: instance-manager
{{- /* NOTE: this should allow only the port range 10000-30000 but many CNIs do not support endPort :-(
ports:
- protocol: TCP
port: 10000
endPort: 30000
*/}}
- to:
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
{{- /* NOTE: this should allow only the port range 30001-31000 but many CNIs do not support endPort :-(
ports:
- protocol: TCP
port: 30001
endPort: 31000
*/}}
- to:
- podSelector:
matchLabels:
longhorn.io/component: backing-image-data-source
ports:
- protocol: TCP
port: 8000
{{- end }}
45 changes: 31 additions & 14 deletions chart/templates/network-policies/instance-manager-networking.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,36 @@ spec:
matchLabels:
longhorn.io/component: instance-manager
policyTypes:
- Ingress
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: longhorn-manager
- podSelector:
matchLabels:
longhorn.io/component: instance-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-manager
- podSelector:
matchLabels:
longhorn.io/component: backing-image-data-source
- from:
- podSelector:
matchLabels:
app: longhorn-manager
ports:
- protocol: TCP
port: 8500
- protocol: TCP
port: 8501
- protocol: TCP
port: 8502
- protocol: TCP
port: 8503
- protocol: TCP
port: 8504
- from:
- podSelector:
matchExpressions:
- key: longhorn.io/component
operator: In
values:
- instance-manager
- backing-image-manager
- backing-image-data-source
{{- /* NOTE: this should allow only the port range 10000-30000 but many CNIs do not support endPort :-(
ports:
- protocol: TCP
port: 10000
endPort: 30000
*/}}
{{- end }}
44 changes: 22 additions & 22 deletions chart/templates/network-policies/manager-network-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,27 +9,27 @@ spec:
matchLabels:
app: longhorn-manager
policyTypes:
- Ingress
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: longhorn-manager
- podSelector:
matchLabels:
app: longhorn-ui
- podSelector:
matchLabels:
app: longhorn-csi-plugin
- podSelector:
matchLabels:
longhorn.io/managed-by: longhorn-manager
matchExpressions:
- { key: recurring-job.longhorn.io, operator: Exists }
- podSelector:
matchExpressions:
- { key: longhorn.io/job-task, operator: Exists }
- podSelector:
matchLabels:
app: longhorn-driver-deployer
- from:
- podSelector:
matchExpressions:
- key: app
operator: In
values:
- longhorn-manager
- longhorn-ui
- longhorn-csi-plugin
- longhorn-driver-deployer
- podSelector:
matchLabels:
longhorn.io/managed-by: longhorn-manager
matchExpressions:
- { key: recurring-job.longhorn.io, operator: Exists }
- podSelector:
matchExpressions:
- { key: longhorn.io/job-task, operator: Exists }
ports:
- port: 9500
protocol: TCP
{{- end }}
13 changes: 10 additions & 3 deletions chart/templates/network-policies/ui-frontend-network-policy.yaml
View file
Open in desktop
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes might be not sufficient especially when no ingress controller is used. See: #9067 (comment)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, this case is not addressed in this pull request. I was focusing on "simple" improvements that don't depend on any configuration, but the review is taking too long regardless... 😞

Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ spec:
app: longhorn-ui
policyTypes:
- Ingress
- Egress
ingress:
- from:
{{- if eq .Values.networkPolicies.type "rke1"}}
Expand Down Expand Up @@ -37,10 +38,16 @@ spec:
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
{{- end }}
ports:
- port: 8000
protocol: TCP
- port: 80
protocol: TCP
{{- end }}
egress:
- to:
- podSelector:
matchLabels:
app: longhorn-manager
ports:
- port: 9500
protocol: TCP
{{- end }}
25 changes: 0 additions & 25 deletions examples/network-policy/backing-image-data-source-network-policy.yaml
View file
Open in desktop

This file was deleted.

22 changes: 0 additions & 22 deletions examples/network-policy/backing-image-manager-network-policy.yaml
View file
Open in desktop

This file was deleted.

22 changes: 0 additions & 22 deletions examples/network-policy/instance-manager-networking.yaml
View file
Open in desktop

This file was deleted.

33 changes: 0 additions & 33 deletions examples/network-policy/manager-network-policy.yaml
View file
Open in desktop

This file was deleted.

16 changes: 0 additions & 16 deletions examples/network-policy/recovery-backend-network-policy.yaml
View file
Open in desktop

This file was deleted.

23 changes: 0 additions & 23 deletions examples/network-policy/ui-network-policy.yaml
View file
Open in desktop

This file was deleted.

Loading