Kubernetes: add deny all global network policy

[YuryHrytsuk]

What do these changes do?

Add global default deny all network policy following https://docs.tigera.io/calico/latest/network-policy/get-started/kubernetes-default-deny.

This means all applications by default will only be able to talk to kube dns server (via port 53).

In order to allow other traffic, a network policy for an application needs to be explicitly specified. As example, we start with portainer and adminer applications. Other existing applications will be added after. All new applications (as long as they use their own namespace) will be restricted by global deny network policy automatically.

Implementation details

Since calico is currently installed via kubespray and has no configuration in helm, we add a separate helm chart to keep calico configuration (in this case global policy only)

Make portainer a custom chart (with dependency from portainer k8s helm chart). This lets us create a network policy for the portainer in the same chart and reuse values. It is very unfortunate that Portainer does not support extra objects, so we have to create a separate chart with dependency.

Important:

• We add network policy checksum to ensure pods are restarted no policy change. This way we can be sure network policy are applied properly (see Profile rules take precendence over (Global) Network Policy rules projectcalico/calico#10753)
  • Portainer chart does not implement pod annotations, so this technique cannot be applied

FYI @GitHK this is an example of denying network for apps that will solve https://github.com/ITISFoundation/private-issues/issues/45. Also @pcrespov may appreciate these enforced by default security measures

Related issue/s

• Kubernetes security: implement global default network policy denying everything #1138
• next steps: remove non-system pods from selector of global network policy (simcore, cert-manager, ...)
• Kubespray does not support installing calico v3.30 that has Whisker GUI to debug Network Policies Add calico v3.30 support kubernetes-sigs/kubespray#12444

Related PR/s

• Config changes https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/1526

Checklist

• I tested and it works

[matusdrobuliak66]

👀

[GitHK]

👍

[mrnicegyu11]

deep 🛞 k8s stuff, looks good from what I can see. left a few minor comments, but no blockers found

[YuryHrytsuk]

This won't work since we don't have Calico API server installed on master deployment (see kubernetes-sigs/kubespray#12445). Calico API server is needed to use projectcalico.org/v3 objects (e.g. network policies).

Until it is installed we cannot continue

[YuryHrytsuk]

This won't work since we don't have Calico API server installed on master deployment (see kubernetes-sigs/kubespray#12445). Calico API server is needed to use projectcalico.org/v3 objects (e.g. network policies).

Until it is installed we cannot continue

Unblocked by https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/1527. Calico API server is installed now