Add Network Policies

[risonjic]

The network segmentation between Pods within the Kubernetes database namespaces is insufficient due to
missing Network Policies.

[eberlep]

I think we will only need to handle ingresss, not egress.

And we will probably need an ipBlock (for the requests to the database port from the load balancer) and a namespaceSelector podSelector (for access to patroni from within the same namespace)

Work in progress, could look something like this:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: <DATABASE-NAMESPACE>
spec:
  podSelector:
    matchLabels:
      # labels to select the database itself (use the default labels added by postgreslet per cluster/instance)
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16 # LoadBalancer IP? for access via the LoadBalancer
    - ipBlock:
        cidr: 172.17.0.0/16 # also add the standby cluster ip, in case it runs in the same cluster for testing?
    - podSelector:
        matchLabels:
          # labels to select the operator (use the default labels added by postgreslet per cluster/instance)
    ports:
    - protocol: TCP
      port: 5432
  - from:
    - podSelector:
        matchLabels:
          # labels to select the postgreslet itself (for our replication configuration)
    ports:
    - protocol: TCP
      port: 8008

We also need a default-deny policy.

Required Access:

• operator -> patroni
• postgreslet -> patroni
• postgres -> postgres (replication)
• load balancer -> postgres
• prometheus -> postgres-exporter

[eberlep]

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-allow-postgres
spec:
  podSelector: 
    matchLabels:
      application: spilo
      postgres.database.fits.cloud/tenant: Ft
  egress:
  # Postgres Cluster
  - to:
    - podSelector: 
        matchLabels:
          application: spilo
          postgres.database.fits.cloud/tenant: Ft
  # CoreDNS
  - to:
    - namespaceSelector:
        matchLabels:
          gardener.cloud/purpose: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
  # etcd
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - port: 2379
      protocol: TCP
  # S3 (Backup/Restore)
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - port: 443
      protocol: TCP
    # TODO standby -> primary
  policyTypes:
  - Egress