feat(tn): add gateway network policy (#129)

allow tenant gateway to reach gateway operator

Author: plnordquist-pnnl

charts/charts/tenant-namespace/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 type: application
 description: Chart for setting up a tenants namespace with all the goodies
 name: tenant-namespace
-version: 0.9.3
+version: 0.9.4
 appVersion: "1.0"
 dependencies:
 - name: magic-namespace

charts/charts/tenant-namespace/templates/gateway-tenant-networkpolicy.yaml

@@ -0,0 +1,46 @@
+{{- if (and .Values.gateway.enabled .Values.gateway.networkPolicy.enabled (eq .Values.gateway.deploymentMode "tenant")) }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-gateway
+  namespace: {{ .Values.magicnamespace.namespace }}
+  labels:
+    {{- include "namespace.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{ template "namespace.gatewayName" . }}
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    # Allow envoy to reach gateway operator
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ default "envoy-gateway-system" .Values.gateway.networkPolicy.envoyGateway.operatorNamespace }}
+      podSelector:
+        matchLabels:
+          {{- if .Values.gateway.networkPolicy.envoyGateway.operatorPodMatchLabels }}
+          {{ toYaml .Values.gateway.networkPolicy.envoyGateway.operatorPodMatchLabels | nindent 10 }}
+          {{- else }}
+          app.kubernetes.io/name: gateway-helm
+          {{- end }}
+    ports:
+    - port: {{ default 18000 .Values.gateway.networkPolicy.envoyGateway.operatorPort }}
+  {{- if .Values.gateway.networkPolicy.envoyGateway.rateLimitEnabled }}
+  # Allow envoy to reach ratelimit deployment
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ default "envoy-gateway-system" .Values.gateway.networkPolicy.envoyGateway.operatorNamespace }}
+      podSelector:
+        matchLabels:
+          {{- if .Values.gateway.networkPolicy.envoyGateway.rateLimitPodMatchLabels }}
+          {{ toYaml .Values.gateway.networkPolicy.envoyGateway.rateLimitPodMatchLabels | nindent 10 }}
+          {{- else }}
+          app.kubernetes.io/name: envoy-ratelimit
+          {{- end }}
+    ports:
+    - port: {{ default 8081 .Values.gateway.networkPolicy.envoyGateway.rateLimitPort }}
+  {{- end }}
+{{- end }}

charts/charts/tenant-namespace/values.yaml

@@ -123,7 +123,17 @@ gateway:
 #    group: gateway.envoyproxy.io
 #    kind: EnvoyProxy
 #    name: project-gateway
-
+  networkPolicy:
+    enabled: false
+    envoyGateway: {}
+#      operatorNamespace: envoy-gateway-system
+#      operatorPort: 18000
+#      operatorPodMatchLabels:
+#        app.kubernetes.io/name: gateway-helm
+#      rateLimitEnabled: false
+#      rateLimitPort: 8081
+#      rateLimitPodMatchLabels:
+#        app.kubernetes.io/name: envoy-ratelimit
 
 quota:
   enabled: true