Add NetworkPolicy for CockroachDB (#1594)

stable/cockroachdb/Chart.yaml

@@ -1,6 +1,6 @@
 name: cockroachdb
 home: https://www.cockroachlabs.com
-version: 0.3.1
+version: 0.4.0
 appVersion: 1.0.3
 description: CockroachDB is a scalable, survivable, strongly-consistent SQL database.
 icon: https://raw.githubusercontent.com/cockroachdb/cockroach/master/docs/media/cockroach_db.png

stable/cockroachdb/README.md

@@ -47,6 +47,8 @@ The following tables lists the configurable parameters of the CockroachDB chart
 | `Storage`               | Persistent volume size             | `1Gi`                                                      |
 | `StorageClass`          | Persistent volume class            | `anything`                                                 |
 | `ClusterDomain`         | Cluster's default DNS domain       | `cluster.local`                                            |
+| `NetworkPolicy.Enabled` | Enable NetworkPolicy               | `false`                                                    |
+| `NetworkPolicy.AllowExternal` | Don't require client label for connections | `true`                                       |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
 
@@ -178,6 +180,22 @@ nodeID:     2
 [...]
 ```
 
+## NetworkPolicy
+
+To enable network policy for CockroachDB,
+install [a networking plugin that implements the Kubernetes
+NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin),
+and set `NetworkPolicy.Enabled` to `true`.
+
+For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting
+the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace:
+
+    kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}"
+
+For more precise policy, set `networkPolicy.allowExternal=false`. This will
+only allow pods with the generated client label to connect to CockroachDB.
+This label will be displayed in the output of a successful install.
+
 ## Scaling
 
 Scaling should typically be managed via the `helm upgrade` command, but StatefulSets

stable/cockroachdb/templates/NOTES.txt

@@ -9,9 +9,16 @@ For example, you can open up a SQL shell to the cluster by running:
 
     kubectl run -it --rm cockroach-client \
         --image=cockroachdb/cockroach \
-        --restart=Never \
+        --restart=Never \{{- if and (.Values.NetworkPolicy.Enabled) (not .Values.NetworkPolicy.AllowExternal) }}
+        --labels="{{.Release.Name}}-{{.Values.Component}}-client=true" \{{- end }}
         --command -- ./cockroach sql --insecure --host {{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-public.{{ .Release.Namespace }}
 
+{{ if and (.Values.NetworkPolicy.Enabled) (not .Values.NetworkPolicy.AllowExternal) }}
+Note: Since NetworkPolicy is enabled, only pods with label
+{{.Release.Name}}-{{.Values.Component}}-client=true"
+will be able to connect to this cockroachdb cluster.
+{{- end }}
+
 From there, you can interact with the SQL shell as you would any other SQL shell,
 confident that any data you write will be safe and available even if parts of
 your cluster fail.

stable/cockroachdb/templates/_helpers.tpl

@@ -0,0 +1,10 @@
+{{/*
+Return the appropriate apiVersion for networkpolicy.
+*/}}
+{{- define "networkPolicy.apiVersion" -}}
+{{- if and (ge .Capabilities.KubeVersion.Minor "4") (le .Capabilities.KubeVersion.Minor "6") -}}
+{{- print "extensions/v1beta1" -}}
+{{- else if ge .Capabilities.KubeVersion.Minor "7" -}}
+{{- print "networking.k8s.io/v1" -}}
+{{- end -}}
+{{- end -}}

stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml

@@ -0,0 +1,36 @@
+{{- if .Values.NetworkPolicy.Enabled }}
+---
+kind: NetworkPolicy
+apiVersion: {{ template "networkPolicy.apiVersion" . }}
+metadata:
+  name: "{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}"
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    component: "{{ .Release.Name }}-{{ .Values.Component }}"
+spec:
+  podSelector:
+    matchLabels:
+      component: "{{.Release.Name}}-{{.Values.Component}}"
+  ingress:
+  - ports:
+    - port: {{ .Values.GrpcPort}}
+    {{- if not .Values.NetworkPolicy.AllowExternal }}
+    from:
+    # Allow clients to connect.
+    - podSelector:
+        matchLabels:
+          {{.Release.Name}}-{{.Values.Component}}-client: "true"
+    # Allow other cockroachdb's to connect to form cluster.
+    - podSelector:
+        matchLabels:
+          component: "{{.Release.Name}}-{{.Values.Component}}"
+    {{- end }}
+  # Allow connections to admin UI.
+  - ports:
+    - port: {{.Values.HttpPort}}
+  # Allow connections from Prometheus.
+  - ports:
+    - port: 8080
+{{- end }}

stable/cockroachdb/values.yaml

@@ -21,3 +21,6 @@ Resources:
 Storage: "1Gi"
 StorageClass: "anything"
 ClusterDomain: "cluster.local"
+NetworkPolicy:
+  Enabled: false
+  AllowExternal: true