Allow to configure service network policy

The patch introduces network policy configuration similar
to openstack-helm services. It allows users to configure
policies depending on the environment.

* Network policies are disabled by default.
* When enabled default policies allow all ingress and
  egress traffic (i.e. policy set to {}), this may be
  changed in future patch-sets.

Change-Id: I288ad9ad82d4820d70cccd26b73d3c1a44862f9e
This commit is contained in:
Evgeny L 2019-09-20 19:52:13 +00:00
parent 5641cc1117
commit 9871309fda
2 changed files with 26 additions and 0 deletions

View File

@ -0,0 +1,18 @@
# Copyright 2017-2018 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
{{- if .Values.manifests.network_policy -}}
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "maas" -}}
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
{{- end -}}

View File

@ -75,6 +75,13 @@ dependencies:
- service: maas_ingress - service: maas_ingress
endpoint: monitor endpoint: monitor
network_policy:
maas:
ingress:
- {}
egress:
- {}
manifests: manifests:
region_statefulset: true region_statefulset: true
rack_statefulset: true rack_statefulset: true
@ -85,6 +92,7 @@ manifests:
ingress_region: true ingress_region: true
configmap_ingress: true configmap_ingress: true
maas_ingress: true maas_ingress: true
network_policy: false
images: images:
tags: tags: