easylinux/kube-prometheus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1650 from ArthurSens/as/network-policies

Browse Source 
Adds NetworkPolicies to all components of Kube-prometheus
This commit is contained in:
Arthur Silva Sens
2022-04-05 09:47:05 +01:00
committed by GitHub
parent a182d78794 3ad08674b3
commit 01004de76c
24 changed files with 577 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
jsonnet/kube-prometheus/components/alertmanager.libsonnet
View File

@@ -103,6 +103,51 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: am.service.metadata,
spec: {
podSelector: {
matchLabels: am._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [
{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, am.service.spec.ports),
},
// Alertmanager cluster peer-to-peer communication
{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'alertmanager',
},
},
}],
ports: [{
port: 9094,
protocol: 'TCP',
}, {
port: 9094,
protocol: 'UDP',
}],
},
],
},
},
secret: {
apiVersion: 'v1',
kind: 'Secret',

26
jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
View File

@@ -250,6 +250,32 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: bb.service.metadata,
spec: {
podSelector: {
matchLabels: bb._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, bb.service.spec.ports),
}],
},
},
service: {
apiVersion: 'v1',
kind: 'Service',

26
jsonnet/kube-prometheus/components/grafana.libsonnet
View File

@@ -84,6 +84,32 @@ function(params)
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: g.service.metadata,
spec: {
podSelector: {
matchLabels: g._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, g.service.spec.ports),
}],
},
},
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
// 'readOnlyRootFilesystem: true' and extra volumeMounts can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.

26
jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
View File

@@ -124,6 +124,32 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
image: ksm._config.kubeRbacProxyImage,
}),
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: ksm.service.metadata,
spec: {
podSelector: {
matchLabels: ksm._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, ksm.service.spec.ports),
}],
},
},
deployment+: {
spec+: {
template+: {

26
jsonnet/kube-prometheus/components/node-exporter.libsonnet
View File

@@ -160,6 +160,32 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: ne.service.metadata,
spec: {
podSelector: {
matchLabels: ne._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, ne.service.spec.ports),
}],
},
},
daemonset:
local nodeExporter = {
name: ne._config.name,

15
jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
View File

@@ -206,6 +206,21 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: pa.service.metadata,
spec: {
podSelector: {
matchLabels: pa._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
// Prometheus-adapter needs ingress allowed so HPAs can request metrics from it.
ingress: [{}],
},
},
deployment:
local c = {
name: pa._config.name,

26
jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
View File

@@ -72,6 +72,32 @@ function(params)
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: po.service.metadata,
spec: {
podSelector: {
matchLabels: po._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, po.service.spec.ports),
}],
},
},
service+: {
spec+: {
ports: [

26
jsonnet/kube-prometheus/components/prometheus.libsonnet
View File

@@ -94,6 +94,32 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: p.service.metadata,
spec: {
podSelector: {
matchLabels: p._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, p.service.spec.ports),
}],
},
},
serviceAccount: {
apiVersion: 'v1',
kind: 'ServiceAccount',