Skip to content

Commit f333fe7

Browse files
EamonZhangEamonZhang
committed
chore(prometheus): add networkpolicy
1 parent 5b9b75b commit f333fe7

5 files changed

Lines changed: 117 additions & 28 deletions

File tree

‎addons/prometheus/2/chart/prometheus/templates/bind.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
credential:
2+
{{- if (eq .Values.server.service.type "LoadBalancer") }}
3+
- name: host
4+
valueFrom:
5+
serviceRef:
6+
name: {{ printf "%s" (include "common.names.fullname" .) }}
7+
jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
8+
- name: database
9+
valueFrom:
10+
secretKeyRef:
11+
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
12+
jsonpath: '{ .data.database }'
13+
- name: password
14+
valueFrom:
15+
secretKeyRef:
16+
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
17+
jsonpath: '{ .data.username }'
18+
- name: username
19+
valueFrom:
20+
secretKeyRef:
21+
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
22+
jsonpath: '{ .data.username }'
23+
- name: portrw
24+
valueFrom:
25+
secretKeyRef:
26+
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
27+
jsonpath: '{ .data.portrw }'
28+
- name: portro
29+
valueFrom:
30+
secretKeyRef:
31+
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
32+
jsonpath: '{ .data.portro }'
33+
{{- end }}
34+

‎addons/prometheus/2/chart/prometheus/templates/networkpolicy.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{{- /*
2+
Copyright VMware, Inc.
3+
SPDX-License-Identifier: APACHE-2.0
4+
*/}}
5+
6+
{{- if .Values.networkPolicy.enabled }}
7+
kind: NetworkPolicy
8+
apiVersion: {{ template "common.capabilities.networkPolicy.apiVersion" . }}
9+
metadata:
10+
name: {{ template "common.names.fullname" . }}
11+
namespace: {{ include "common.names.namespace" . | quote }}
12+
labels: {{- include "common.labels.standard" . | nindent 4 }}
13+
{{- if .Values.commonLabels }}
14+
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
15+
{{- end }}
16+
{{- if .Values.commonAnnotations }}
17+
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
podSelector:
21+
matchLabels:
22+
{{- include "common.labels.matchLabels" . | nindent 6 }}
23+
ingress:
24+
# Allow inbound connections
25+
- ports:
26+
- port: {{ .Values.alertmanager.service.ports.http }}
27+
- port: {{ .Values.alertmanager.service.ports.cluster }}
28+
- port: {{ .Values.alertmanager.containerPorts.http }}
29+
- port: {{ .Values.alertmanager.containerPorts.cluster }}
30+
- port: {{ .Values.server.containerPorts.http }}
31+
- port: {{ .Values.server.service.ports.http }}
32+
{{- if or .Values.networkPolicy.allowCurrentNamespace .Values.networkPolicy.allowNamespaces }}
33+
from:
34+
{{- if .Values.networkPolicy.allowCurrentNamespace }}
35+
- namespaceSelector:
36+
matchLabels:
37+
kubernetes.io/metadata.name: {{ .Release.Namespace }}
38+
{{- end }}
39+
{{- range $namespace := .Values.networkPolicy.allowNamespaces }}
40+
{{- if $namespace }}
41+
- namespaceSelector:
42+
matchLabels:
43+
kubernetes.io/metadata.name: {{ $namespace }}
44+
{{- end }}
45+
{{- end }}
46+
{{- end }}
47+
{{- end }}

‎addons/prometheus/2/chart/prometheus/values.yaml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@ alertmanager:
360360
ingress:
361361
## @param alertmanager.ingress.enabled Enable ingress record generation for Alertmanager
362362
##
363-
enabled: false
363+
enabled: true
364364
## @param alertmanager.ingress.pathType Ingress path type
365365
##
366366
pathType: ImplementationSpecific
@@ -1225,7 +1225,7 @@ server:
12251225
ingress:
12261226
## @param server.ingress.enabled Enable ingress record generation for Prometheus
12271227
##
1228-
enabled: false
1228+
enabled: true
12291229
## @param server.ingress.pathType Ingress path type
12301230
##
12311231
pathType: ImplementationSpecific
@@ -1460,6 +1460,20 @@ server:
14601460
##
14611461
rules: []
14621462

1463+
## Prometheus Nework Policy configuration
1464+
##
1465+
networkPolicy:
1466+
## @param networkPolicy.enabled Enable creation of NetworkPolicy resources
1467+
##
1468+
enabled: true
1469+
## @param networkPolicy.allowExternal The Policy model to apply.
1470+
## When set to false, only pods with the correct
1471+
## client label will have network access to the port MySQL is listening
1472+
## on. When true, MySQL will accept connections from any source
1473+
## (with the correct destination port).
1474+
##
1475+
allowCurrentNamespace: true
1476+
allowNamespaces: []
14631477
## @section Init Container Parameters
14641478
##
14651479

‎addons/prometheus/2/plans/standard-10/bind.yaml‎

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,28 @@
11
credential:
2-
{{- if (eq .Values.router.service.type "LoadBalancer") }}
2+
{{- if (eq .Values.server.service.type "LoadBalancer") }}
33
- name: host
44
valueFrom:
55
serviceRef:
6-
name: {{ printf "%s-router" (include "common.names.fullname" .) }}
6+
name: {{ printf "%s" (include "common.names.fullname" .) }}
77
jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
8-
- name: database
8+
- name: port
99
valueFrom:
1010
secretKeyRef:
11-
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
12-
jsonpath: '{ .data.database }'
13-
- name: password
14-
valueFrom:
15-
secretKeyRef:
16-
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
17-
jsonpath: '{ .data.username }'
18-
- name: username
19-
valueFrom:
20-
secretKeyRef:
21-
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
22-
jsonpath: '{ .data.username }'
23-
- name: portrw
11+
name: {{ template "common.names.fullname" . }}
12+
jsonpath: '{ .spec.ports.port }'
13+
{{- end }}
14+
15+
alertmanager
16+
17+
{{- if (eq .Values.alertmanager.service.type "LoadBalancer") }}
18+
- name: host
2419
valueFrom:
25-
secretKeyRef:
26-
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
27-
jsonpath: '{ .data.portrw }'
28-
- name: portro
20+
serviceRef:
21+
name: {{ printf "%s" (include "common.names.fullname" .) }}
22+
jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
23+
- name: port
2924
valueFrom:
3025
secretKeyRef:
31-
name: {{ template "common.names.fullname" . }}-svcbind-custom-user
32-
jsonpath: '{ .data.portro }'
33-
{{- end }}
34-
26+
name: {{ template "common.names.fullname" . }}
27+
jsonpath: '{ .spec.ports.port }'
28+
{{- end }}

‎addons/prometheus/2/plans/standard-50/bind.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
credential:
2-
{{- if (eq .Values.router.service.type "LoadBalancer") }}
2+
{{- if (eq .Values.service.type "LoadBalancer") }}
33
- name: host
44
valueFrom:
55
serviceRef:
6-
name: {{ printf "%s-router" (include "common.names.fullname" .) }}
6+
name: {{ printf "%s" (include "common.names.fullname" .) }}
77
jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
88
- name: database
99
valueFrom:

0 commit comments

Comments
 (0)