Skip to content

Commit 41df8d4

Browse files
pstadermannpstadermann
authored
NetworkPolicies are not allow to scrape Prometheus metrics #87 (#92)
Allow configuring access to gateway and gdscan with * gateway.networkPolicy.ingressNSMatchLabels * gateway.networkPolicy.ingressNSPodMatchLabels * gdscan.networkPolicy.ingressNSMatchLabels * gdscan.networkPolicy.ingressNSPodMatchLabels Co-authored-by: Philip Stadermann <[email protected]>
1 parent 5ee3c52 commit 41df8d4

File tree

4 files changed

+53
-1
lines changed

4 files changed

+53
-1
lines changed

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,8 @@ In addition, Sentry will always behave as follows:
215215
| gateway.nameOverride | Overrides the application name | "" |
216216
| gateway.fullnameOverride | Overrides the full name | "" |
217217
| gateway.networkPolicy.enabled | Enable/Disable the default Network Policy | false |
218+
| gateway.networkPolicy.ingressNSMatchLabels | Labels to match to allow traffic from other namespaces | {} |
219+
| gateway.networkPolicy.ingressNSPodMatchLabels | Pod labels to match to allow traffic from other namespaces | {} |
218220
| gateway.service.type | Type of Kubernetes service | "" |
219221
| gateway.service.http.port | HTTP port for the service | 8080 |
220222
| gateway.service.ws.port | WebSocket port for the service | 9090 |
@@ -231,6 +233,9 @@ In addition, Sentry will always behave as follows:
231233
| gateway.nodeSelector | Node labels for pod assignment | {} |
232234
| gateway.affinity | Affinity settings for pods | {} |
233235
| gateway.terminationGracePeriodSeconds | Max time in seconds for scans to complete | 30 |
236+
| gdscan.networkPolicy.enabled | Enable/Disable the default Network Policy | false |
237+
| gdscan.networkPolicy.ingressNSMatchLabels | Labels to match to allow traffic from other namespaces | {} |
238+
| gdscan.networkPolicy.ingressNSPodMatchLabels | Pod labels to match to allow traffic from other namespaces | {} |
234239
| gdscan.nodeSelector | gdscan node labels for pod assignment | {} |
235240
| gdscan.replicaCount | Number of replicas for the gdscan deployment | 1 |
236241
| gdscan.terminationGracePeriodSeconds | Max time in seconds for scans to complete. Set to same value as gateway.terminationGracePeriodSeconds | 30 |
@@ -364,4 +369,4 @@ You can generate the upload token signing key with
364369
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 256 | head -n 1
365370
```
366371

367-
<!-- end::ProductionEnviroment[] -->
372+
<!-- end::ProductionEnviroment[] -->

‎charts/vaas/templates/gateway/networkpolicy.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,25 @@ spec:
4848
ports:
4949
- port: 53
5050
protocol: UDP
51+
{{- if or .Values.gateway.networkPolicy.ingressNSMatchLabels .Values.gateway.networkPolicy.ingressNSPodMatchLabels }}
52+
- from:
53+
- namespaceSelector:
54+
matchLabels:
55+
{{- if .Values.gateway.networkPolicy.ingressNSMatchLabels }}
56+
{{- range $key, $value := .Values.gateway.networkPolicy.ingressNSMatchLabels }}
57+
{{ $key | quote }}: {{ $value | quote }}
58+
{{- end }}
59+
{{ else }}
60+
{}
61+
{{- end }}
62+
{{- if .Values.gateway.networkPolicy.ingressNSPodMatchLabels }}
63+
podSelector:
64+
matchLabels:
65+
{{- range $key, $value := .Values.gateway.networkPolicy.ingressNSPodMatchLabels }}
66+
{{ $key | quote }}: {{ $value | quote }}
67+
{{- end }}
68+
{{- end }}
69+
ports:
70+
- port: 8080 # Upload
71+
{{- end }}
5172
{{- end }}

‎charts/vaas/templates/gdscan/networkpolicy.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,24 @@ spec:
1616
- podSelector:
1717
matchLabels:
1818
app.kubernetes.io/name: gateway
19+
{{- if or .Values.gdscan.networkPolicy.ingressNSMatchLabels .Values.gdscan.networkPolicy.ingressNSPodMatchLabels }}
20+
- namespaceSelector:
21+
matchLabels:
22+
{{- if .Values.gdscan.networkPolicy.ingressNSMatchLabels }}
23+
{{- range $key, $value := .Values.gdscan.networkPolicy.ingressNSMatchLabels }}
24+
{{ $key | quote }}: {{ $value | quote }}
25+
{{- end }}
26+
{{ else }}
27+
{}
28+
{{- end }}
29+
{{- if .Values.gdscan.networkPolicy.ingressNSPodMatchLabels }}
30+
podSelector:
31+
matchLabels:
32+
{{- range $key, $value := .Values.gdscan.networkPolicy.ingressNSPodMatchLabels }}
33+
{{ $key | quote }}: {{ $value | quote }}
34+
{{- end }}
35+
{{- end }}
36+
{{- end }}
1937
ports:
2038
- port: 8080 # Upload
2139
{{- end }}

‎charts/vaas/values.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,10 @@ gateway:
111111

112112
networkPolicy:
113113
enabled: true
114+
# ingressNSMatchLabels:
115+
# kubernetes.io/metadata.name: prometheus
116+
# ingressNSPodMatchLabels:
117+
# app.kubernetes.io/name: prometheus
114118

115119
service:
116120
type: ClusterIP
@@ -214,6 +218,10 @@ gdscan:
214218

215219
networkPolicy:
216220
enabled: true
221+
# ingressNSMatchLabels:
222+
# kubernetes.io/metadata.name: prometheus
223+
# ingressNSPodMatchLabels:
224+
# app.kubernetes.io/name: prometheus
217225

218226
podAnnotations: {}
219227

0 commit comments

Comments
 (0)