easylinux/kube-prometheus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add networkPolicies for alertmanager, grafana, prometheus-operator and prometheus

Browse Source 
Signed-off-by: GitHub <noreply@github.com>
(cherry picked from commit 86e16b539cc57710b50f4692848cab5645e3d2bc)
This commit is contained in:
Arthur Silva Sens
2022-02-17 08:24:45 +00:00
committed by ArthurSens
parent 030dec7656
commit ea158da23f
11 changed files with 292 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
jsonnet/kube-prometheus/components/alertmanager.libsonnet
View File

@@ -103,6 +103,32 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: am.service.metadata,
spec: {
podSelector: {
matchLabels: am._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, am.service.spec.ports),
}],
},
},
secret: {
apiVersion: 'v1',
kind: 'Secret',

26
jsonnet/kube-prometheus/components/grafana.libsonnet
View File

@@ -84,6 +84,32 @@ function(params)
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: g.service.metadata,
spec: {
podSelector: {
matchLabels: g._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, g.service.spec.ports),
}],
},
},
// FIXME(ArthurSens): The securityContext overrides can be removed after some PRs get merged
// 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
// 'readOnlyRootFilesystem: true' and extra volumeMounts can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.

26
jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
View File

@@ -72,6 +72,32 @@ function(params)
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: po.service.metadata,
spec: {
podSelector: {
matchLabels: po._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, po.service.spec.ports),
}],
},
},
service+: {
spec+: {
ports: [

26
jsonnet/kube-prometheus/components/prometheus.libsonnet
View File

@@ -94,6 +94,32 @@ function(params) {
},
},
networkPolicy: {
apiVersion: 'networking.k8s.io/v1',
kind: 'NetworkPolicy',
metadata: p.service.metadata,
spec: {
podSelector: {
matchLabels: p._config.selectorLabels,
},
policyTypes: ['Egress', 'Ingress'],
egress: [{}],
ingress: [{
from: [{
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'prometheus',
},
},
}],
ports: std.map(function(o) {
port: o.port,
protocol: 'TCP',
}, p.service.spec.ports),
}],
},
},
serviceAccount: {
apiVersion: 'v1',
kind: 'ServiceAccount',