Public Access
f.weber
1675ea9a4e
- Updated Chart.yaml to version 0.2.0 and added annotations for changes. - Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases. - Introduced ServiceAccount configuration in values.yaml and related templates. - Adjusted internal container ports to prevent conflicts between nginx and aptly. - Updated README.md and NOTES.txt to reflect new configurations and usage instructions.
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
{{- if .Values.networkPolicy.enabled }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: {{ include "aptly.fullname" . }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
{{- include "aptly.selectorLabels" . | nindent 6 }}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
{{- if .Values.networkPolicy.allowedNamespaces }}
|
|
# Restricted to these namespaces (plus this one). NOTE: this applies to
|
|
# the whole nginx endpoint — read and write share one port, so this
|
|
# cannot itself express "reads are public, writes are cluster-only" any
|
|
# more precisely than security.write.allowCIDRs can (see the warning
|
|
# rendered into nginx.conf for that). Use it to fence the Service off
|
|
# from unrelated namespaces, not as a read/write split.
|
|
- from:
|
|
- podSelector: {}
|
|
{{- range .Values.networkPolicy.allowedNamespaces }}
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: {{ . }}
|
|
{{- end }}
|
|
{{- else }}
|
|
- {}
|
|
{{- end }}
|
|
{{- with .Values.networkPolicy.extraIngress }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
egress:
|
|
{{- if .Values.networkPolicy.egress.allowAll }}
|
|
- {}
|
|
{{- else }}
|
|
- to:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
{{- with .Values.networkPolicy.egress.extra }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|