feat(testkube): add networkpolicy support #784
Conversation
windowsrefund
requested review from
dejanzele,
emil2k and
ypoplavs
as code owners
| egress: | ||
| - to: | ||
| - podSelector: | ||
| matchLabels: |
There was a problem hiding this comment.
Can this be done similar to how services use a helper method? Example https://github.com/kubeshop/helm-charts/blob/develop/charts/testkube-api/templates/service.yaml#L27
There was a problem hiding this comment.
feel free to refactor to your hearts content
| namespace: testkube | ||
| spec: | ||
| podSelector: | ||
| matchLabels: |
There was a problem hiding this comment.
same as above comment for selector
| ingress: | ||
| - ports: | ||
| - protocol: TCP | ||
| port: 9443 |
There was a problem hiding this comment.
Can this also be referenced through a param?
| egress: | ||
| - to: | ||
| - podSelector: | ||
| matchLabels: |
There was a problem hiding this comment.
same comment for selectors
| port: 4222 | ||
| - to: | ||
| - podSelector: | ||
| matchLabels: |
There was a problem hiding this comment.
same comment for selectors, they should be used through a helper funcion (from the mongodb chart?)
| ports: | ||
| - protocol: TCP | ||
| port: 4222 | ||
| - to: |
There was a problem hiding this comment.
this might need to be dynamic if mongodb is disabled (customer is bringing own mongo)
|
Could this support CiliumNetworkPolicy as well? Some inspiration could be taken from datadogs implementation https://github.com/DataDog/helm-charts/blob/61736e9132b9a44a268ae266bc45c99f78a7491e/charts/datadog/values.yaml#L798 |
|
Just wanted to mention these rules are still valid against the 2.0.17 Helm chart. |
Pull request description
Adds Network Policies support
Checklist (choose whats happened)
Breaking changes
Changes
Fixes
Additional Info
This will be useful to those folks who use network policies with a default-deny configuration. Only Testkube-specific traffic has been accommodated for and by default, these resources will not be created (must enable in values.yaml). I came up with these rules by watching for PacketDrop events (provided by kube-iptables-tailor) in the testkube namespace while running my Test Suites, etc. Hopefully, I didn't miss anything! Also, I am still on 1.16.64 so I added support for the dashboard if enabled.
I didn't update the README as I came to believe it may be auto-generated. LMK if I'm wrong and I'll be happy to update accordingly.
To see the template rendered:
Now from inside the testkube chart directory