[stable/rabbitmq] Add NetworkPolicy simple support. (#19304)

* [stable/rabbitmq] Add NetworkPolicy simple support.

Signed-off-by: Cédric de Saint Martin <cdesaintmartin@wiremind.fr>

* Fix after review.

Signed-off-by: Cédric de Saint Martin <cdesaintmartin@wiremind.fr>

stable/rabbitmq/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: rabbitmq
-version: 6.13.1
+version: 6.14.0
 appVersion: 3.8.2
 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP)
 keywords:

stable/rabbitmq/README.md

@@ -118,6 +118,9 @@ The following table lists the configurable parameters of the RabbitMQ chart and
 | `resources`                                  | resource needs and limits to apply to the pod    | {}                                                      |
 | `replicas`                                   | Replica count                                    | `1`                                                     |
 | `priorityClassName`                          | Pod priority class name                          | ``                                                      |
+| `networkPolicy.enabled`                      | Enable NetworkPolicy                             | `false`                                                 |
+| `networkPolicy.allowExternal`                | Don't require client label for connections       | `true`                                                  |
+| `networkPolicy.additionalRules`              | Additional NetworkPolicy rules                   | `nil`                                                   |
 | `nodeSelector`                               | Node labels for pod assignment                   | {}                                                      |
 | `affinity`                                   | Affinity settings for pod assignment             | {}                                                      |
 | `tolerations`                                | Toleration labels for pod assignment             | []                                                      |

stable/rabbitmq/ci/default-values.yaml

@@ -0,0 +1 @@
+# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml.

stable/rabbitmq/ci/networkpolicy-values.yaml

@@ -0,0 +1,11 @@
+networkPolicy:
+  enable: true
+  allowExternal: false
+  additionalRules:
+    - matchLabels:
+      - role: foo
+    - matchExpressions:
+      - key: role
+        operator: In
+        values:
+          - bar

stable/rabbitmq/templates/networkpolicy.yaml

@@ -0,0 +1,39 @@
+{{- if .Values.networkPolicy.enabled }}
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ template "rabbitmq.fullname" . }}
+  labels:
+    app: {{ template "rabbitmq.name" . }}
+    chart: {{ template "rabbitmq.chart" . }}
+    release: {{ .Release.Name | quote }}
+    heritage: {{ .Release.Service | quote }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ template "rabbitmq.name" . }}
+      release: {{ .Release.Name | quote }}
+  ingress:
+    # Allow inbound connections
+
+    - ports:
+        - port: 4369  # EPMD
+        - port: {{ .Values.service.port }}
+        - port: {{ .Values.service.tlsPort }}
+        - port: {{ .Values.service.distPort }}
+        - port: {{ .Values.service.managerPort }}
+
+      {{- if not .Values.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels:
+              {{ template "rabbitmq.fullname" . }}-client: "true"
+        {{- with .Values.networkPolicy.additionalRules }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
+      {{- end }}
+
+    # Allow prometheus scrapes
+    - ports:
+        - port: {{ .Values.metrics.port }}
+{{- end }}

stable/rabbitmq/values-production.yaml

@@ -265,6 +265,30 @@ resources:
     memory: 256Mi
     cpu: 100m
 
+networkPolicy:
+  ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
+  ##
+  enabled: false
+
+  ## The Policy model to apply. When set to false, only pods with the correct
+  ## client label will have network access to the port RabbitMQ is listening
+  ## on. When true, RabbitMQ will accept connections from any source
+  ## (with the correct destination port).
+  ##
+  allowExternal: true
+
+  ## Additional NetworkPolicy Ingress "from" rules to set. Note that all rules are OR-ed.
+  ##
+  # additionalRules:
+  #  - matchLabels:
+  #    - role: frontend
+  #  - matchExpressions:
+  #    - key: role
+  #      operator: In
+  #      values:
+  #        - frontend
+
 ## Replica count, set to 3 to provide a default available cluster
 replicas: 3
 

stable/rabbitmq/values.yaml

@@ -262,6 +262,30 @@ persistence:
 ##
 resources: {}
 
+networkPolicy:
+  ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
+  ##
+  enabled: false
+
+  ## The Policy model to apply. When set to false, only pods with the correct
+  ## client label will have network access to the ports RabbitMQ is listening
+  ## on. When true, RabbitMQ will accept connections from any source
+  ## (with the correct destination port).
+  ##
+  allowExternal: true
+
+  ## Additional NetworkPolicy Ingress "from" rules to set. Note that all rules are OR-ed.
+  ##
+  # additionalRules:
+  #  - matchLabels:
+  #    - role: frontend
+  #  - matchExpressions:
+  #    - key: role
+  #      operator: In
+  #      values:
+  #        - frontend
+
 ## Replica count, set to 1 to provide a default available cluster
 replicas: 1