From 20060e3ce9105e08ef80a992f4c2c76cdcb3036e Mon Sep 17 00:00:00 2001 From: "Dan (Turk)" Date: Wed, 9 Aug 2017 16:20:18 -0700 Subject: [PATCH] Add NetworkPolicy for CockroachDB (#1594) --- stable/cockroachdb/Chart.yaml | 2 +- stable/cockroachdb/README.md | 18 ++++++++++ stable/cockroachdb/templates/NOTES.txt | 9 ++++- stable/cockroachdb/templates/_helpers.tpl | 10 ++++++ .../templates/cockroachdb-networkpolicy.yaml | 36 +++++++++++++++++++ stable/cockroachdb/values.yaml | 3 ++ 6 files changed, 76 insertions(+), 2 deletions(-) create mode 100644 stable/cockroachdb/templates/_helpers.tpl create mode 100644 stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml diff --git a/stable/cockroachdb/Chart.yaml b/stable/cockroachdb/Chart.yaml index b008bbd226..41f4171996 100755 --- a/stable/cockroachdb/Chart.yaml +++ b/stable/cockroachdb/Chart.yaml @@ -1,6 +1,6 @@ name: cockroachdb home: https://www.cockroachlabs.com -version: 0.3.1 +version: 0.4.0 appVersion: 1.0.3 description: CockroachDB is a scalable, survivable, strongly-consistent SQL database. icon: https://raw.githubusercontent.com/cockroachdb/cockroach/master/docs/media/cockroach_db.png diff --git a/stable/cockroachdb/README.md b/stable/cockroachdb/README.md index 3d78c1ffaf..ae6724838e 100644 --- a/stable/cockroachdb/README.md +++ b/stable/cockroachdb/README.md @@ -47,6 +47,8 @@ The following tables lists the configurable parameters of the CockroachDB chart | `Storage` | Persistent volume size | `1Gi` | | `StorageClass` | Persistent volume class | `anything` | | `ClusterDomain` | Cluster's default DNS domain | `cluster.local` | +| `NetworkPolicy.Enabled` | Enable NetworkPolicy | `false` | +| `NetworkPolicy.AllowExternal` | Don't require client label for connections | `true` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. @@ -178,6 +180,22 @@ nodeID: 2 [...] ``` +## NetworkPolicy + +To enable network policy for CockroachDB, +install [a networking plugin that implements the Kubernetes +NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), +and set `NetworkPolicy.Enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting +the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + + kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" + +For more precise policy, set `networkPolicy.allowExternal=false`. This will +only allow pods with the generated client label to connect to CockroachDB. +This label will be displayed in the output of a successful install. + ## Scaling Scaling should typically be managed via the `helm upgrade` command, but StatefulSets diff --git a/stable/cockroachdb/templates/NOTES.txt b/stable/cockroachdb/templates/NOTES.txt index f55557ac56..5914cc86ab 100644 --- a/stable/cockroachdb/templates/NOTES.txt +++ b/stable/cockroachdb/templates/NOTES.txt @@ -9,9 +9,16 @@ For example, you can open up a SQL shell to the cluster by running: kubectl run -it --rm cockroach-client \ --image=cockroachdb/cockroach \ - --restart=Never \ + --restart=Never \{{- if and (.Values.NetworkPolicy.Enabled) (not .Values.NetworkPolicy.AllowExternal) }} + --labels="{{.Release.Name}}-{{.Values.Component}}-client=true" \{{- end }} --command -- ./cockroach sql --insecure --host {{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}-public.{{ .Release.Namespace }} +{{ if and (.Values.NetworkPolicy.Enabled) (not .Values.NetworkPolicy.AllowExternal) }} +Note: Since NetworkPolicy is enabled, only pods with label +{{.Release.Name}}-{{.Values.Component}}-client=true" +will be able to connect to this cockroachdb cluster. +{{- end }} + From there, you can interact with the SQL shell as you would any other SQL shell, confident that any data you write will be safe and available even if parts of your cluster fail. diff --git a/stable/cockroachdb/templates/_helpers.tpl b/stable/cockroachdb/templates/_helpers.tpl new file mode 100644 index 0000000000..2ee6409fef --- /dev/null +++ b/stable/cockroachdb/templates/_helpers.tpl @@ -0,0 +1,10 @@ +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "networkPolicy.apiVersion" -}} +{{- if and (ge .Capabilities.KubeVersion.Minor "4") (le .Capabilities.KubeVersion.Minor "6") -}} +{{- print "extensions/v1beta1" -}} +{{- else if ge .Capabilities.KubeVersion.Minor "7" -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} diff --git a/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml b/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml new file mode 100644 index 0000000000..6aa04f6c91 --- /dev/null +++ b/stable/cockroachdb/templates/cockroachdb-networkpolicy.yaml @@ -0,0 +1,36 @@ +{{- if .Values.NetworkPolicy.Enabled }} +--- +kind: NetworkPolicy +apiVersion: {{ template "networkPolicy.apiVersion" . }} +metadata: + name: "{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}" + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + component: "{{ .Release.Name }}-{{ .Values.Component }}" +spec: + podSelector: + matchLabels: + component: "{{.Release.Name}}-{{.Values.Component}}" + ingress: + - ports: + - port: {{ .Values.GrpcPort}} + {{- if not .Values.NetworkPolicy.AllowExternal }} + from: + # Allow clients to connect. + - podSelector: + matchLabels: + {{.Release.Name}}-{{.Values.Component}}-client: "true" + # Allow other cockroachdb's to connect to form cluster. + - podSelector: + matchLabels: + component: "{{.Release.Name}}-{{.Values.Component}}" + {{- end }} + # Allow connections to admin UI. + - ports: + - port: {{.Values.HttpPort}} + # Allow connections from Prometheus. + - ports: + - port: 8080 +{{- end }} diff --git a/stable/cockroachdb/values.yaml b/stable/cockroachdb/values.yaml index 4497283fba..666ad63770 100644 --- a/stable/cockroachdb/values.yaml +++ b/stable/cockroachdb/values.yaml @@ -21,3 +21,6 @@ Resources: Storage: "1Gi" StorageClass: "anything" ClusterDomain: "cluster.local" +NetworkPolicy: + Enabled: false + AllowExternal: true