Add network policies for rhoai (#1023)

* Add allow-from-redhat-ods-app-to-mariadb network policy * Add allow-from-redhat-ods-app-to-mm network policy * Add network policies to base tier too * Update deploy/templates/nstemplatetiers/base/ns_stage.yaml * Update deploy/templates/nstemplatetiers/base/ns_stage.yaml * Update deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml * Update deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml * Update deploy/templates/nstemplatetiers/base/ns_dev.yaml * Update deploy/templates/nstemplatetiers/base/ns_dev.yaml --------- Co-authored-by: Alexey Kazakov <alkazako@redhat.com>
codeready-toolchain · May 3, 2024 · dbf0c82 · dbf0c82
1 parent 3693380
commit dbf0c82
Show file tree

Hide file tree

Showing 3 changed files with 114 additions and 0 deletions.
diff --git a/deploy/templates/nstemplatetiers/base/ns_dev.yaml b/deploy/templates/nstemplatetiers/base/ns_dev.yaml
@@ -188,6 +188,44 @@ objects:
     podSelector: {}
     policyTypes:
     - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mariadb
+    namespace: ${SPACE_NAME}-dev
+  spec:
+    podSelector: 
+      matchLabels:
+        app: mariadb-dspa
+    ingress:
+      - ports:
+          - protocol: TCP
+            port: 3306
+        from:
+          - podSelector:
+              matchLabels:
+                app.kubernetes.io/name: data-science-pipelines-operator
+            namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mm
+    namespace: ${SPACE_NAME}-dev
+  spec:
+    podSelector:
+      matchLabels:
+        modelmesh-service: modelmesh-serving
+    ingress:
+      - from:
+          - namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
 parameters:
 - name: SPACE_NAME
   required: true
diff --git a/deploy/templates/nstemplatetiers/base/ns_stage.yaml b/deploy/templates/nstemplatetiers/base/ns_stage.yaml
@@ -188,6 +188,44 @@ objects:
     podSelector: {}
     policyTypes:
     - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mariadb
+    namespace: ${SPACE_NAME}-stage
+  spec:
+    podSelector: 
+      matchLabels:
+        app: mariadb-dspa
+    ingress:
+      - ports:
+          - protocol: TCP
+            port: 3306
+        from:
+          - podSelector:
+              matchLabels:
+                app.kubernetes.io/name: data-science-pipelines-operator
+            namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mm
+    namespace: ${SPACE_NAME}-stage
+  spec:
+    podSelector:
+      matchLabels:
+        modelmesh-service: modelmesh-serving
+    ingress:
+      - from:
+          - namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
 parameters:
 - name: SPACE_NAME
   required: true
diff --git a/deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml b/deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml
@@ -214,6 +214,44 @@ objects:
     podSelector: {}
     policyTypes:
     - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mariadb
+    namespace: ${SPACE_NAME}-dev
+  spec:
+    podSelector: 
+      matchLabels:
+        app: mariadb-dspa
+    ingress:
+      - ports:
+          - protocol: TCP
+            port: 3306
+        from:
+          - podSelector:
+              matchLabels:
+                app.kubernetes.io/name: data-science-pipelines-operator
+            namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
+- apiVersion: networking.k8s.io/v1
+  kind: NetworkPolicy
+  metadata:
+    name: allow-from-redhat-ods-app-to-mm
+    namespace: ${SPACE_NAME}-dev
+  spec:
+    podSelector:
+      matchLabels:
+        modelmesh-service: modelmesh-serving
+    ingress:
+      - from:
+          - namespaceSelector:
+              matchLabels:
+                kubernetes.io/metadata.name: redhat-ods-applications
+    policyTypes:
+      - Ingress
 parameters:
 - name: SPACE_NAME
   required: true