-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[tempo] Add Network Policy capability #2922
Open
Sheikh-Abubaker
wants to merge
25
commits into
grafana:main
Choose a base branch
from
Sheikh-Abubaker:tempo-pr
base: main
Could not load branches
Branch not found: {{ refName }}
Could not load tags
Nothing to show
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from 4 commits
Commits
Show all changes
25 commits
Select commit
Hold shift + click to select a range
7862f07
Added Network Policy for tempo
Sheikh-Abubaker 5d91088
Updated README.md
Sheikh-Abubaker 27d7a46
Updated README.md
Sheikh-Abubaker b39a68b
Updated README.md
Sheikh-Abubaker 593209b
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 813d4cf
Updated values.yaml
Sheikh-Abubaker 389462d
Updated values.yaml
Sheikh-Abubaker ab4a11a
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker ee5e4cb
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 9009b0a
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 30b2ca3
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 3e50a89
Resolved conflicts
Sheikh-Abubaker 566d824
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 8f15ccc
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 922e85b
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker ad6b11b
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker a15c86a
Merge branch 'main' into tempo-pr
zanhsieh 31e32b9
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 864b41b
Merge branch 'tempo-pr' of https://github.com/Sheikh-Abubaker/helm-ch…
Sheikh-Abubaker d8dd03a
Merge branch 'main' into tempo-pr
zanhsieh 30ab33c
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker 7d20bd9
Merge branch 'tempo-pr' of https://github.com/Sheikh-Abubaker/helm-ch…
Sheikh-Abubaker 347f7b2
Merge branch 'main' into tempo-pr
zanhsieh e4ae24f
Merge branch 'main' of https://github.com/Sheikh-Abubaker/helm-charts…
Sheikh-Abubaker b107a90
Merge branch 'tempo-pr' of https://github.com/Sheikh-Abubaker/helm-ch…
Sheikh-Abubaker File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
{{- if .Values.networkPolicy.enabled }} | ||
apiVersion: networking.k8s.io/v1 | ||
kind: NetworkPolicy | ||
metadata: | ||
name: {{ include "tempo.fullname" . }} | ||
namespace: {{ .Release.Namespace }} | ||
labels: | ||
{{- include "tempo.labels" . | nindent 4 }} | ||
{{- with .Values.labels }} | ||
{{- toYaml . | nindent 4 }} | ||
{{- end }} | ||
{{- with .Values.annotations }} | ||
annotations: | ||
{{- toYaml . | nindent 4 }} | ||
{{- end }} | ||
spec: | ||
policyTypes: | ||
{{- if .Values.networkPolicy.ingress }} | ||
- Ingress | ||
{{- end }} | ||
{{- if .Values.networkPolicy.egress.enabled }} | ||
- Egress | ||
{{- end }} | ||
podSelector: | ||
matchLabels: | ||
{{- include "tempo.selectorLabels" . | nindent 6 }} | ||
|
||
{{- if .Values.networkPolicy.egress.enabled }} | ||
egress: | ||
{{- if not .Values.networkPolicy.egress.blockDNSResolution }} | ||
- ports: | ||
- port: 53 | ||
protocol: UDP | ||
{{- end }} | ||
- ports: | ||
{{ .Values.networkPolicy.egress.ports | toJson }} | ||
{{- with .Values.networkPolicy.egress.to }} | ||
to: | ||
{{- toYaml . | nindent 12 }} | ||
{{- end }} | ||
{{- end }} | ||
{{- if .Values.networkPolicy.ingress }} | ||
ingress: | ||
- ports: | ||
- port: {{ .Values.service.targetPort }} | ||
{{- if not .Values.networkPolicy.allowExternal }} | ||
from: | ||
- podSelector: | ||
matchLabels: | ||
{{ include "tempo.fullname" . }}-client: "true" | ||
{{- with .Values.networkPolicy.explicitNamespacesSelector }} | ||
- namespaceSelector: | ||
{{- toYaml . | nindent 12 }} | ||
{{- end }} | ||
- podSelector: | ||
matchLabels: | ||
{{- include "tempo.labels" . | nindent 14 }} | ||
role: read | ||
{{- end }} | ||
{{- end }} | ||
{{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -10,6 +10,9 @@ replicas: 1 | |
# -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) | ||
# revisionHistoryLimit: 1 | ||
|
||
# -- labels for tempo | ||
labels: {} | ||
|
||
# -- Annotations for the StatefulSet | ||
annotations: {} | ||
|
||
|
@@ -256,6 +259,7 @@ service: | |
type: ClusterIP | ||
annotations: {} | ||
labels: {} | ||
targetPort: "" | ||
|
||
serviceMonitor: | ||
enabled: false | ||
|
@@ -294,3 +298,68 @@ affinity: {} | |
|
||
# -- The name of the PriorityClass | ||
priorityClassName: null | ||
|
||
networkPolicy: | ||
## @param networkPolicy.enabled Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. | ||
## | ||
enabled: false | ||
## @param networkPolicy.allowExternal Don't require client label for connections | ||
## The Policy model to apply. When set to false, only pods with the correct | ||
## client label will have network access to tempo port defined. | ||
## When true, tempo will accept connections from any source | ||
## (with the correct destination port). | ||
## | ||
ingress: true | ||
## @param networkPolicy.ingress When true enables the creation | ||
## an ingress network policy | ||
## | ||
allowExternal: true | ||
## @param networkPolicy.explicitNamespacesSelector A Kubernetes LabelSelector to explicitly select namespaces from which traffic could be allowed | ||
## If explicitNamespacesSelector is missing or set to {}, only client Pods that are in the networkPolicy's namespace | ||
## and that match other criteria, the ones that have the good label, can reach the tempo. | ||
## But sometimes, we want the tempo to be accessible to clients from other namespaces, in this case, we can use this | ||
## LabelSelector to select these namespaces, note that the networkPolicy's namespace should also be explicitly added. | ||
## | ||
## Example: | ||
## explicitNamespacesSelector: | ||
## matchLabels: | ||
## role: frontend | ||
## matchExpressions: | ||
## - {key: role, operator: In, values: [frontend]} | ||
## | ||
explicitNamespacesSelector: {} | ||
## | ||
## | ||
## | ||
## | ||
## | ||
## | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can you get rid of extra comment lines? |
||
egress: | ||
## @param networkPolicy.egress.enabled When enabled, an egress network policy will be | ||
## created allowing tempo to connect to external data sources from kubernetes cluster. | ||
enabled: false | ||
## | ||
## @param networkPolicy.egress.blockDNSResolution When enabled, DNS resolution will be blocked | ||
## for all pods in the tempo namespace. | ||
blockDNSResolution: false | ||
## | ||
## @param networkPolicy.egress.ports Add individual ports to be allowed by the egress | ||
ports: [] | ||
## Add ports to the egress by specifying - port: <port number> | ||
## E.X. | ||
## - port: 80 | ||
## - port: 443 | ||
## | ||
## @param networkPolicy.egress.to Allow egress traffic to specific destinations | ||
to: [] | ||
## Add destinations to the egress by specifying - ipBlock: <CIDR> | ||
## E.X. | ||
## to: | ||
## - namespaceSelector: | ||
## matchExpressions: | ||
## - {key: role, operator: In, values: [tempo]} | ||
## | ||
## | ||
## | ||
## | ||
## | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can you get rid of extra comment lines? |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think feature should bump to minor version: