config: bring back ingressOverride

Author: davidumea

config/common-config.yaml

@@ -1196,6 +1196,10 @@ networkPolicies:
 
   ingressNginx:
     enabled: true
+    ingressOverride:
+      enabled: set-me
+      ips:
+        - set-me-if-(.networkPolicies.ingressNginx.ingressOverride.enabled)
 
   falco:
     enabled: true

config/providers/aws/common-config.yaml

@@ -21,6 +21,9 @@ networkPolicies:
   global:
     externalLoadBalancer: false
     ingressUsingHostNetwork: false
+  ingressNginx:
+    ingressOverride:
+      enabled: false
 opa:
   rejectLoadBalancerService:
     enabled: false

config/providers/azure/common-config.yaml

@@ -20,10 +20,9 @@ networkPolicies:
   global:
     externalLoadBalancer: false
     ingressUsingHostNetwork: false
-    scIngress:
-      ips:
-        - 0.0.0.0/0
-    wcIngress:
+  ingressNginx:
+    ingressOverride:
+      enabled: true
       ips:
         - 0.0.0.0/0
 opa:

config/providers/baremetal/common-config.yaml

@@ -16,6 +16,9 @@ networkPolicies:
     ingressUsingHostNetwork: true
   rookCeph:
     enabled: true
+  ingressNginx:
+    ingressOverride:
+      enabled: false
 opa:
   rejectLoadBalancerService:
     enabled: true

config/providers/elastx/common-config.yaml

@@ -17,6 +17,9 @@ networkPolicies:
   global:
     externalLoadBalancer: false
     ingressUsingHostNetwork: false
+  ingressNginx:
+    ingressOverride:
+      enabled: false
 objectStorage:
   type: s3
   s3:

config/providers/openstack/common-config.yaml

@@ -15,6 +15,9 @@ networkPolicies:
   global:
     externalLoadBalancer: false
     ingressUsingHostNetwork: false
+  ingressNginx:
+    ingressOverride:
+      enabled: false
 objectStorage:
   type: s3
   s3:

config/providers/safespring/common-config.yaml

@@ -8,6 +8,9 @@ networkPolicies:
   global:
     externalLoadBalancer: true
     ingressUsingHostNetwork: true
+  ingressNginx:
+    ingressOverride:
+      enabled: false
   kubeSystem:
     openstack:
       enabled: true

config/providers/upcloud/common-config.yaml

@@ -4,6 +4,9 @@ networkPolicies:
   global:
     externalLoadBalancer: true
     ingressUsingHostNetwork: false
+  ingressNginx:
+    ingressOverride:
+      enabled: false
   kubeSystem:
     upcloud:
       enabled: true

config/schemas/config.yaml

@@ -1253,6 +1253,28 @@ allOf:
                     properties:
                       ips:
                         $ref: '#/$defs/iplist'
+- if:
+    properties:
+      networkPolicies:
+        properties:
+          ingressNginx:
+            properties:
+              ingressOverride:
+                properties:
+                  enabled:
+                    type: boolean
+                    const: true
+  then:
+    properties:
+      networkPolicies:
+        properties:
+          ingressNginx:
+            properties:
+              ingressOverride:
+                properties:
+                  ips:
+                    title: Network Policies Ingress Override IPs
+                    $ref: '#/$defs/iplist'
 - if:
     allOf:
       - properties:
@@ -7309,6 +7331,20 @@ properties:
             title: Network Policies Ingress NGINX Enabled
             type: boolean
             default: true
+          ingressOverride:
+            title: Network Policies Ingress Override
+            description: |-
+              Configure override to the ingress rules for Ingress NGINX.
+
+              Required when cluster ingress uses direct routing.
+            type: object
+            additionalProperties: false
+            properties:
+              enabled:
+                title: Network Policies Ingress Override Enabled
+                type: boolean
+                default: false
+              ips: true
       certManager:
         title: Network Policies cert-manager
         description: Configure cert-manager network policy rules.

helmfile.d/charts/networkpolicy/service-cluster/templates/ingress-nginx/controller.yaml

@@ -22,9 +22,14 @@ spec:
         - protocol: TCP
           port: 80
     {{- end }}
-    {{- if or  .Values.global.scNodes.ips .Values.global.scIngress.ips }}
+    {{- if or .Values.ingressNginx.ingressOverride.ips .Values.global.scNodes.ips .Values.global.scIngress.ips }}
     - from:
-      {{- if .Values.global.ingressUsingHostNetwork }}
+      {{- if and .Values.ingressNginx.ingressOverride.enabled .Values.ingressNginx.ingressOverride.ips }}
+        {{- range $IP := .Values.ingressNginx.ingressOverride.ips }}
+        - ipBlock:
+            cidr: {{ $IP }}
+        {{- end }}
+      {{- else if not (or .Values.global.externalLoadBalancer .Values.global.ingressUsingHostNetwork) }}
         {{- if .Values.global.scNodes.ips }}
         {{- range $IP := .Values.global.scNodes.ips }}
         - ipBlock:
@@ -82,9 +87,14 @@ spec:
         protocol: UDP
       - port: 53
         protocol: TCP
-    {{- if .Values.global.scIngress.ips }}
+    {{- if or .Values.ingressNginx.ingressOverride.ips .Values.global.scIngress.ips }}
     - to:
-      {{- if .Values.global.scIngress.ips }}
+      {{- if and .Values.ingressNginx.ingressOverride.enabled .Values.ingressNginx.ingressOverride.ips }}
+        {{- range $IP := .Values.ingressNginx.ingressOverride.ips }}
+        - ipBlock:
+            cidr: {{ $IP }}
+        {{- end }}
+      {{- else if .Values.global.scIngress.ips }}
         {{- range $IP := .Values.global.scIngress.ips }}
         - ipBlock:
             cidr: {{ $IP }}