Skip to content

Commit 3ddeddb

Browse files
bmalynovytchbmalynovytch
committed
Add ingress4netpol-knocking
1 parent 5e07504 commit 3ddeddb

8 files changed

Lines changed: 339 additions & 0 deletions

File tree

‎charts/ingress4netpol-knocking/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/ingress4netpol-knocking/Chart.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v2
2+
name: ingress4netpol-knocking
3+
description: Knock the ingress to open the ports on Kubernetes with NetworkPolicies
4+
version: 0.1.0

‎charts/ingress4netpol-knocking/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "ingress4netpol-knocking.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "ingress4netpol-knocking.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "ingress4netpol-knocking.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "ingress4netpol-knocking.labels" -}}
37+
helm.sh/chart: {{ include "ingress4netpol-knocking.chart" . }}
38+
{{ include "ingress4netpol-knocking.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "ingress4netpol-knocking.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "ingress4netpol-knocking.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "ingress4netpol-knocking.serviceAccountName" -}}
57+
{{- if .Values.rbac.create }}
58+
{{- default (include "ingress4netpol-knocking.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/ingress4netpol-knocking/templates/deployment.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "ingress4netpol-knocking.fullname" . }}
5+
labels:
6+
{{- include "ingress4netpol-knocking.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "ingress4netpol-knocking.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "ingress4netpol-knocking.labels" . | nindent 8 }}
20+
{{- with .Values.podLabels }}
21+
{{- toYaml . | nindent 8 }}
22+
{{- end }}
23+
spec:
24+
{{- with .Values.imagePullSecrets }}
25+
imagePullSecrets:
26+
{{- toYaml . | nindent 8 }}
27+
{{- end }}
28+
serviceAccountName: {{ include "ingress4netpol-knocking.serviceAccountName" . }}
29+
securityContext:
30+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
31+
containers:
32+
- name: {{ .Chart.Name }}
33+
securityContext:
34+
{{- toYaml .Values.securityContext | nindent 12 }}
35+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
36+
imagePullPolicy: {{ .Values.image.pullPolicy }}
37+
lifecycle:
38+
preStop:
39+
exec:
40+
command: ["/bin/sh","-c","pkill -ef apache2 ; while pgrep -f apache2 ; do sleep 1 ; done ; /cleanup-network-policies.sh 9999999999"]
41+
env:
42+
- name: NETPOL_TARGET_LABELS
43+
value: {{ range $k, $v := .Values.networkPolicies.targetLabels }}{{ $k }}={{ $v }},{{ end }}
44+
- name: NETPOL_OPERATOR_LABELS
45+
value: {{ range $k, $v := fromYaml (include "ingress4netpol-knocking.labels" .) }}{{ $k }}={{ $v }},{{ end }}{{ with .Values.podLabels }},{{ range $k, $v := . }},{{ end }}{{ end }}
46+
- name: NETPOL_ALLOW_PORTS
47+
value: {{ join "," .Values.networkPolicies.allowPorts }}
48+
- name: NETPOL_NAME
49+
value: {{ .Release.Name }}-{{ .Values.networkPolicies.namePrefix }}
50+
- name: NETPOL_DURATION
51+
value: {{ .Values.networkPolicies.allowDuration | quote }}
52+
- name: NETPOL_NAMESPACE
53+
value: {{ .Release.Namespace }}
54+
{{- with .Values.networkPolicies.proxyHeader }}
55+
- name: NETPOL_PROXY_HEADER
56+
value: {{ . }}
57+
{{- end }}
58+
{{- with .Values.networkPolicies.trustedProxies }}
59+
- name: NETPOL_TRUSTED_PROXIES
60+
value: {{ join "," . | quote }}
61+
{{- end }}
62+
ports:
63+
- name: http
64+
containerPort: {{ .Values.service.port }}
65+
protocol: TCP
66+
livenessProbe:
67+
{{- toYaml .Values.livenessProbe | nindent 12 }}
68+
readinessProbe:
69+
{{- toYaml .Values.readinessProbe | nindent 12 }}
70+
resources:
71+
{{- toYaml .Values.resources | nindent 12 }}
72+
{{- with .Values.volumeMounts }}
73+
volumeMounts:
74+
{{- toYaml . | nindent 12 }}
75+
{{- end }}
76+
{{- with .Values.volumes }}
77+
volumes:
78+
{{- toYaml . | nindent 8 }}
79+
{{- end }}
80+
{{- with .Values.nodeSelector }}
81+
nodeSelector:
82+
{{- toYaml . | nindent 8 }}
83+
{{- end }}
84+
{{- with .Values.affinity }}
85+
affinity:
86+
{{- toYaml . | nindent 8 }}
87+
{{- end }}
88+
{{- with .Values.tolerations }}
89+
tolerations:
90+
{{- toYaml . | nindent 8 }}
91+
{{- end }}

‎charts/ingress4netpol-knocking/templates/ingress.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{- if .Values.ingress.enabled -}}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: {{ include "ingress4netpol-knocking.fullname" . }}
6+
labels:
7+
{{- include "ingress4netpol-knocking.labels" . | nindent 4 }}
8+
{{- with .Values.ingress.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
spec:
13+
{{- with .Values.ingress.className }}
14+
ingressClassName: {{ . }}
15+
{{- end }}
16+
{{- if .Values.ingress.tls }}
17+
tls:
18+
{{- range .Values.ingress.tls }}
19+
- hosts:
20+
{{- range .hosts }}
21+
- {{ . | quote }}
22+
{{- end }}
23+
secretName: {{ .secretName }}
24+
{{- end }}
25+
{{- end }}
26+
rules:
27+
{{- range .Values.ingress.hosts }}
28+
- host: {{ .host | quote }}
29+
http:
30+
paths:
31+
{{- range .paths }}
32+
- path: {{ .path }}
33+
{{- with .pathType }}
34+
pathType: {{ . }}
35+
{{- end }}
36+
backend:
37+
service:
38+
name: {{ include "ingress4netpol-knocking.fullname" $ }}
39+
port:
40+
number: {{ $.Values.service.port }}
41+
{{- end }}
42+
{{- end }}
43+
{{- end }}

‎charts/ingress4netpol-knocking/templates/rbac.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if .Values.rbac.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "ingress4netpol-knocking.serviceAccountName" . }}
6+
labels:
7+
{{- include "ingress4netpol-knocking.labels" . | nindent 4 }}
8+
---
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
kind: Role
11+
metadata:
12+
name: {{ include "ingress4netpol-knocking.fullname" . }}
13+
rules:
14+
- apiGroups: ["networking.k8s.io"]
15+
resources: ["networkpolicies"]
16+
verbs: ["*"]
17+
---
18+
apiVersion: rbac.authorization.k8s.io/v1
19+
kind: RoleBinding
20+
metadata:
21+
name: {{ include "ingress4netpol-knocking.fullname" . }}
22+
subjects:
23+
- kind: ServiceAccount
24+
name: {{ include "ingress4netpol-knocking.serviceAccountName" . }}
25+
namespace: {{ .Release.Namespace }}
26+
roleRef:
27+
kind: Role
28+
name: {{ include "ingress4netpol-knocking.fullname" . }}
29+
apiGroup: rbac.authorization.k8s.io
30+
{{- end }}

‎charts/ingress4netpol-knocking/templates/service.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ include "ingress4netpol-knocking.fullname" . }}
5+
labels:
6+
{{- include "ingress4netpol-knocking.labels" . | nindent 4 }}
7+
spec:
8+
type: {{ .Values.service.type }}
9+
ports:
10+
- port: {{ .Values.service.port }}
11+
targetPort: http
12+
protocol: TCP
13+
name: http
14+
selector:
15+
{{- include "ingress4netpol-knocking.selectorLabels" . | nindent 4 }}

‎charts/ingress4netpol-knocking/values.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
image:
2+
repository: admantic/k8s-ingress4netpol-knocking
3+
pullPolicy: IfNotPresent
4+
tag: v0.1.6
5+
6+
imagePullSecrets: []
7+
nameOverride: ""
8+
fullnameOverride: ""
9+
10+
rbac:
11+
create: true
12+
13+
ingress:
14+
enabled: false
15+
className: ""
16+
annotations: {}
17+
# kubernetes.io/ingress.class: nginx
18+
# kubernetes.io/tls-acme: "true"
19+
hosts: []
20+
# - host: chart-example.local
21+
# paths:
22+
# - path: /CHANGEME-BY-A-RANDOM-STRING
23+
# pathType: Prefix
24+
tls: []
25+
# - secretName: chart-example-tls
26+
# hosts:
27+
# - chart-example.local
28+
29+
networkPolicies:
30+
namePrefix: ingress4netpol-knocking
31+
targetLabels: {}
32+
# app.kubernetes.io/name: myApp
33+
# app.kubernetes.io/managed-by: Helm
34+
# release: myRelease
35+
allowPorts: []
36+
# - 30000/TCP
37+
allowDuration: 60 # minutes
38+
proxyHeader: ~
39+
trustedProxies: [] # single IPs, PHP lib doesn't support CIDR
40+
41+
service:
42+
type: ClusterIP
43+
port: 80
44+
45+
serviceAccount:
46+
annotations: {}
47+
name: ""
48+
49+
podAnnotations: {}
50+
podLabels: {}
51+
52+
podSecurityContext: {}
53+
# fsGroup: 2000
54+
55+
securityContext:
56+
runAsUser: 0
57+
readOnlyRootFilesystem: false
58+
59+
resources: {}
60+
# We usually recommend not to specify default resources and to leave this as a conscious
61+
# choice for the user. This also increases chances charts run on environments with little
62+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
63+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
64+
# limits:
65+
# cpu: 100m
66+
# memory: 128Mi
67+
# requests:
68+
# cpu: 100m
69+
# memory: 128Mi
70+
71+
tolerations: []

0 commit comments

Comments
 (0)