Network policies#

Overview#

In order to deploy multiple contracts on a same k8s cluster, we choose to set up network policies in order to segregate network streams.

Target#

The network policies operate only on the "contract" namespaces. Those namespaces are suffixed by the contract zone name, and are related to grafana, loki, or prometheus. For example, for the obs-test04 contract zone, the concerned namespaces are:

grafana-client-obs-test04
loki-client-obs-test04
monitoring-stack-client-obs-test04

In order to simplify those namespaces identification, we will labelize them with the contract label. Based on the current example, the label will be contact=obs-test04.

Objectives#

For the targeted namespaces, the goal is to allow ingress traffic only from specified known sources. Those sources are the following:

Traffic coming from the same contract zone
Traffic coming from ingress controllers
Traffic coming from monitoring namespace

Depending on the application, the ingress controller can be private, public or both:

private: Kube-prometheus-stack;
public: Kube-prometheus-stack, Grafana, Loki.

Architecture#

In order to achieve the objective, a sub-chart named isolation-netpol has been added to the following umbrella charts:

grafana-v2
loki-v2
kube-prometheus-stack-v3

SubChart `isolation-netpol`#

Sources#

The chart source code is available on Gitlab
The chart repository is available on ArtifactHub and DockerHub

Composition#

The chart is composed of 2 main elements:

A post install/update hook who take care of the namespace labelization;
The network policy to deploy.

Values#

Regarding the values of the chart, we have:

namespaceLabels (map) who represent the labels to add on the namespace where the chart is deployed. For example:
```
namespaceLabels:
  contract: "obs-test04"
```

allowedNamespacesSelectorLabels (map[]) who represent the namespace selector (based on the name or label), allowed to communicate with the pods in the deployed namespace. For example:

allowedNamespacesSelectorLabels: 
- contract: "obs-test04"            # Allow namespaces with label "contact=obs-test04"
- name: "ingress-nginx-v2-public"   # Allow namespace with name "ingress-nginx-v2-public"
- name: "monitoring"                # Allow namespace with name "monitoring"

Umbrella charts#

Feature switch#

The umbrella charts have the ability to enable/disable this feature thanks to the conditional value isolation-netpol.enabled.

Big picture#

Deployment#

For now, the network policies have been integrated inside the grafana, loki and prometheus umbrella charts as a subchart.

Deployment is done with trackbone and values are defined in associated .cue files.

Implementation details can be found in the following Merge Requests:

Note: Some fine-tuning may be needed. The values may need to be changed according to use cases.

Debug#

Identify the contract namespaces#

To check if the contract label is correctly setup, you can use the following command:

kubectl get ns -l contract=$CONTRACT_ZONE_NAME

Don't forget to define $CONTRACT_ZONE_NAME

Check all the existing network policies#

To see all the network policies deployed on the cluster, and the namespaces associated:

kubectl get netpol -A

Check a specific network policy#

To get information on a network policy deployed:

kubectl describe netpol -n $NAMESPACE

Don't forget to define $NAMESPACE

Note: This command will list all the network policies in the specified namespace