feat: add NetworkPolicy (#357)

Signed-off-by: Matheus Pimenta <[email protected]>

Author: matheuscscp

helm/oauth2-proxy/Chart.yaml

@@ -1,5 +1,5 @@
 name: oauth2-proxy
-version: 8.2.2
+version: 8.3.0
 apiVersion: v2
 appVersion: 7.12.0
 home: https://oauth2-proxy.github.io/oauth2-proxy/
@@ -31,8 +31,8 @@ maintainers:
 kubeVersion: ">=1.16.0-0"
 annotations:
   artifacthub.io/changes: |
-    - kind: security
-      description: Adding cosign keyless signing for helm chart artifact
+    - kind: added
+      description: Add NetworkPolicy manifest to the helm chart
       links:
         - name: Github PR
-          url: https://github.com/oauth2-proxy/manifests/pull/356
+          url: https://github.com/oauth2-proxy/manifests/pull/357

helm/oauth2-proxy/README.md

@@ -181,6 +181,9 @@ The following table lists the configurable parameters of the oauth2-proxy chart
 | `livenessProbe.initialDelaySeconds`                   | number of seconds                                                                                                                                                                                                                                                | 0                                                                                                    |
 | `livenessProbe.timeoutSeconds`                        | number of seconds                                                                                                                                                                                                                                                | 1                                                                                                    |
 | `namespaceOverride`                                   | Override the deployment namespace                                                                                                                                                                                                                                | `""`                                                                                                 |
+| `networkPolicy.create`                                | Create a NetworkPolicy resource                                                                                                                                                                                                                                  | `false`                                                                                              |
+| `networkPolicy.ingress`                               | List of ingress configuration objects                                                                                                                                                                                                                            | `[]`                                                                                                 |
+| `networkPolicy.egress`                                | List of egress configuration objects                                                                                                                                                                                                                             | `[]`                                                                                                 |
 | `nodeSelector`                                        | node labels for pod assignment                                                                                                                                                                                                                                   | `{}`                                                                                                 |
 | `deploymentAnnotations`                               | annotations to add to the deployment                                                                                                                                                                                                                             | `{}`                                                                                                 |
 | `podAnnotations`                                      | annotations to add to each pod                                                                                                                                                                                                                                   | `{}`                                                                                                 |

helm/oauth2-proxy/templates/networkpolicy.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.networkPolicy.create }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "oauth2-proxy.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "oauth2-proxy.labels" . | nindent 4 }}
+    {{- with .Values.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  policyTypes:
+    {{- if .Values.networkPolicy.ingress }}
+    - Ingress
+    {{- end }}
+    {{- if .Values.networkPolicy.egress }}
+    - Egress
+    {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "oauth2-proxy.selectorLabels" . | nindent 6 }}
+  {{- if .Values.networkPolicy.ingress }}
+  ingress:
+    {{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
+  {{- end }}
+  {{- if .Values.networkPolicy.egress }}
+  egress:
+    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+  {{- end }}
+{{- end }}

helm/oauth2-proxy/values.yaml

@@ -177,6 +177,12 @@ serviceAccount:
   automountServiceAccountToken: true
   annotations: {}
 
+# Network policy settings.
+networkPolicy:
+  create: false
+  ingress: []
+  egress: []
+
 ingress:
   enabled: false
   # className: nginx