Skip to content

Commit

Permalink
adding networkpolicy for thanos components
Browse files Browse the repository at this point in the history 
Signed-off-by: Harsh Pratap Singh <[email protected]>
  • Loading branch information
@harsh-ps-2003
harsh-ps-2003 committed Jan 6, 2024
1 parent 4863995 commit 3903229
Show file tree
Hide file tree
Showing 8 changed files with 255 additions and 0 deletions.
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-bucket.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,38 @@ function(params) {
assert std.isNumber(tb.config.replicas) && tb.config.replicas >= 0 : 'thanos bucket replicas has to be number >= 0',
assert std.isObject(tb.config.resources),

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-bucket',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-bucket',
},
},
egress: [{}], // Allow all outside egress to connect to object storage
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
},

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-compact.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,38 @@ function(params) {
assert std.isBoolean(tc.config.serviceMonitor),
assert std.isArray(tc.config.deduplicationReplicaLabels),

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-compact',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-compact',
},
},
egress: [{}], // Allow all outside egress to connect to object storage
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
}

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-query-frontend.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,38 @@ function(params) {
assert std.isBoolean(tqf.config.serviceMonitor),
assert std.isNumber(tqf.config.maxRetries) && tqf.config.maxRetries >= 0 : 'thanos query frontend maxRetries has to be number >= 0',

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-query-frontend',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query-frontend',
},
},
egress: [{}], // Allow all outside egress to connect
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
}

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-query.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,38 @@ function(params) {
assert std.isBoolean(tq.config.autoDownsampling),
assert std.isBoolean(tq.config.useThanosEngine),

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-query',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-store',
},
},
egress: [{}], // Allow all outside egress to connect to object storage
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-store',
},
},
}],
}],
policyTypes: ['Egress'],
},
},

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-receive.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,38 @@ function(params) {
assert std.isObject(tr.config.receiveLimitsConfigFile),
assert std.isObject(tr.config.storeLimits),

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-receive',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-receive',
},
},
egress: [{}], // Allow all outside egress to connect
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
}

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
31 changes: 31 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-rule.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,37 @@ function(params) {
assert std.isObject(tr.config.volumeClaimTemplate),
assert !std.objectHas(tr.config.volumeClaimTemplate, 'spec') || std.assertEqual(tr.config.volumeClaimTemplate.spec.accessModes, ['ReadWriteOnce']) : 'thanos rule PVC accessMode can only be ReadWriteOnce',

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-rule',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-rule',
},
},
egress: [{}], // Allow all outside egress to connect
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
}

service: {
apiVersion: 'v1',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-sidecar.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,38 @@ function(params) {
local tsc = self,
config:: defaults + params,

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-sidecar',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-sidecar',
},
},
egress: [{}], // Allow all outside egress to connect
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
}

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down
32 changes: 32 additions & 0 deletions jsonnet/kube-thanos/kube-thanos-store.libsonnet
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,38 @@ function(params) {
assert std.isObject(ts.config.volumeClaimTemplate),
assert !std.objectHas(ts.config.volumeClaimTemplate, 'spec') || std.assertEqual(ts.config.volumeClaimTemplate.spec.accessModes, ['ReadWriteOnce']) : 'thanos store PVC accessMode can only be ReadWriteOnce',

networkPolicy: {
kind: 'NetworkPolicy',
apiVersion: 'networking.k8s.io/v1',
metadata: {
name: 'thanos-store',
namespace: cfg.namespace,
},
spec: {
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-store',
},
},
egress: [{}], // Allow all outside egress to connect to object storage
ingress: [{
from: [{
namespaceSelector: {
matchLabels: {
'kubernetes.io/metadata.name': cfg.namespace,
},
},
podSelector: {
matchLabels: {
'app.kubernetes.io/name': 'thanos-query',
},
},
}],
}],
policyTypes: ['Egress'],
},
},

service: {
apiVersion: 'v1',
kind: 'Service',
Expand Down

0 comments on commit 3903229

Please sign in to comment.