feat(): allow network policy

Author: Turgon37

charts/node-red/Chart.yaml

@@ -9,7 +9,7 @@ icon: https://nodered.org/about/resources/media/node-red-icon-2.png
 
 type: application
 
-version: 0.40.1
+version: 0.41.0
 appVersion: 4.1.2
 
 keywords:

charts/node-red/templates/ciliumnetworkpolicy.yaml

@@ -0,0 +1,22 @@
+{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ include "node-red.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "node-red.labels" . | nindent 4 }}
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s:app.kubernetes.io/name: '{{ include "node-red.name" . }}'
+      k8s:app.kubernetes.io/instance: '{{ .Release.Name }}'
+  {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.egress }}
+  egress:
+    {{ toYaml .Values.networkPolicy.cilium.egress | nindent 4 }}
+  {{- end }}
+  {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.ingress }}
+  ingress:
+    {{ toYaml .Values.networkPolicy.cilium.ingress | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/node-red/templates/networkpolicy.yaml

@@ -0,0 +1,24 @@
+{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "node-red.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "node-red.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.networkPolicy.egress }}
+  egress:
+    {{- toYaml .Values.networkPolicy.egress | nindent 4 }}
+  {{- end }}
+  {{- if .Values.networkPolicy.ingress }}
+  ingress:
+    {{- toYaml .Values.networkPolicy.ingress | nindent 4 }}
+  {{- end }}
+  policyTypes:
+    - Egress
+    - Ingress
+  podSelector:
+    matchLabels:
+      {{- include "node-red.selectorLabels" . | nindent 4 }}
+{{- end }}

charts/node-red/values.yaml

@@ -199,6 +199,30 @@ ingress:
     # -- Name of the Issuer
     #     name: "test"
 
+# -- Define network policy targeting managed pod
+networkPolicy:
+  enabled: false
+  # -- If cilium flavor is defined, fill definition here
+  cilium:
+    egress:
+    - toPorts:
+      - ports:
+        - port: "1883"
+          protocol: TCP
+        - port: "8883"
+          protocol: TCP
+    ingress: {}
+  # -- Choose policy flavor in 'kubernetes', 'cilium'
+  flavor: kubernetes
+  # -- If kubernetes flavor is defined, fill definition here
+  ingress: {}
+  egress:
+  - ports:
+    - port: 1883
+      protocol: TCP
+    - port: 8883
+      protocol: TCP
+
 # -- Startup probe for the Deployment
 startupProbe:
   httpGet: