From 55c394f414aa6ae37f966667a665e46522c3f7d8 Mon Sep 17 00:00:00 2001 From: Philipp Hossner Date: Wed, 11 Nov 2026 23:47:09 +0100 Subject: [PATCH] charts: allow disabling the bundled NetworkPolicies Fixes #171 Signed-off-by: Philipp Hossner --- charts/substrate/README.md | 1 + .../templates/ate-system-networkpolicies.yaml | 2 ++ .../templates/k8s-credential-provider.yaml | 2 ++ charts/substrate/templates/rustfs.yaml | 2 ++ .../substrate/tests/control_plane_test.yaml | 35 +++++++++++++++++++ charts/substrate/values.yaml | 7 ++++ 6 files changed, 49 insertions(+) diff --git a/charts/substrate/README.md b/charts/substrate/README.md index 35d7bc96c8..105bb9e54d 100644 --- a/charts/substrate/README.md +++ b/charts/substrate/README.md @@ -98,6 +98,7 @@ See `values.yaml` for the full set; the important keys: | `atelet.imageCredentialProviderBinDir` | `""` | Host path to the kubelet credential provider binaries; both paths are mounted read-only | | `credentialProvider.enabled` | `true` | Deploy the Kubernetes Secret provider and route `k8s.io` credential URIs to it. With no provider, every credential injection fails closed | | `credentialProvider.namespacePolicies` | `[]` | Default-deny atespace-to-namespace grants; the chart includes get-only Secret RBAC for the provider | +| `networkPolicies.enabled` | `true` | Render the chart's NetworkPolicies (the release namespace's default deny and allow rules, and those of k8s-credential-provider and RustFS). Set `false` on a cluster that enforces its own policies, which must then admit the same flows | | `ateApi.actorJWTIssuer` | `https://..svc` | Issuer placed in actor JWTs; set a stable URL reachable by relying parties | | `objectStorePlugin.extraEnv` | `[]` | Object storage credentials/settings shared by both object-store plugins | | `objectStorePlugin.control.resources` / `objectStorePlugin.node.resources` | see `values.yaml` | Resources for the API and node object-store sidecars | diff --git a/charts/substrate/templates/ate-system-networkpolicies.yaml b/charts/substrate/templates/ate-system-networkpolicies.yaml index 1b5a99bc3a..4d38912ca1 100644 --- a/charts/substrate/templates/ate-system-networkpolicies.yaml +++ b/charts/substrate/templates/ate-system-networkpolicies.yaml @@ -33,6 +33,7 @@ # # Ports are named rather than numbered where the workloads name them, so the # policy follows the ports exposed by the chart workloads. +{{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -244,3 +245,4 @@ spec: - ports: - protocol: TCP port: https +{{- end }} diff --git a/charts/substrate/templates/k8s-credential-provider.yaml b/charts/substrate/templates/k8s-credential-provider.yaml index b2cd5290bb..b12d962108 100644 --- a/charts/substrate/templates/k8s-credential-provider.yaml +++ b/charts/substrate/templates/k8s-credential-provider.yaml @@ -173,6 +173,7 @@ metadata: data: namespace-policy.yaml: | policies: {{ toJson .Values.credentialProvider.namespacePolicies }} +{{- if .Values.networkPolicies.enabled }} --- # Only the egress gateway may reach the provider's gRPC port; every other # connection to the provider pods is dropped. The provider also pins the @@ -199,3 +200,4 @@ spec: - protocol: TCP port: 50051 {{- end }} +{{- end }} diff --git a/charts/substrate/templates/rustfs.yaml b/charts/substrate/templates/rustfs.yaml index 95a5b10053..bb9fd6c12f 100644 --- a/charts/substrate/templates/rustfs.yaml +++ b/charts/substrate/templates/rustfs.yaml @@ -151,6 +151,7 @@ spec: done echo "timed out waiting for rustfs" exit 1 +{{- if .Values.networkPolicies.enabled }} --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -179,3 +180,4 @@ spec: - protocol: TCP port: api {{- end }} +{{- end }} diff --git a/charts/substrate/tests/control_plane_test.yaml b/charts/substrate/tests/control_plane_test.yaml index 87646b96fc..5510656bc6 100644 --- a/charts/substrate/tests/control_plane_test.yaml +++ b/charts/substrate/tests/control_plane_test.yaml @@ -600,3 +600,38 @@ tests: asserts: - failedTemplate: errorMessage: "atenetEgress.extraCredentialProviders: vault.example.com needs an address as host:port" + +- it: renders the ate-system NetworkPolicies by default + template: ate-system-networkpolicies.yaml + asserts: + - containsDocument: + kind: NetworkPolicy + apiVersion: networking.k8s.io/v1 + +- it: renders no ate-system NetworkPolicies when networkPolicies.enabled is false + template: ate-system-networkpolicies.yaml + set: + networkPolicies.enabled: false + asserts: + - hasDocuments: + count: 0 + +- it: renders no credential provider NetworkPolicy when networkPolicies.enabled is false + template: k8s-credential-provider.yaml + set: + networkPolicies.enabled: false + asserts: + - containsDocument: + kind: NetworkPolicy + apiVersion: networking.k8s.io/v1 + not: true + +- it: renders no RustFS NetworkPolicy when networkPolicies.enabled is false + template: rustfs.yaml + set: + networkPolicies.enabled: false + asserts: + - containsDocument: + kind: NetworkPolicy + apiVersion: networking.k8s.io/v1 + not: true diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml index 5d0f7a4dce..543d142ab9 100644 --- a/charts/substrate/values.yaml +++ b/charts/substrate/values.yaml @@ -202,6 +202,13 @@ credentialProvider: cpu: 500m memory: 256Mi +# Render the chart's NetworkPolicies: the default deny and the allow rules for the +# release namespace, and the policies of k8s-credential-provider and RustFS. A +# cluster that enforces its own policies instead sets false and must admit the +# same flows itself. +networkPolicies: + enabled: true + # Name of a ConfigMap in the release namespace that supplies per-environment # overrides for ate-api-server (ATE_API_POSTGRES_READ_WRITE_CONNECTION_STRING, ...). # Mounted via envFrom with optional=true. Created by the chart from these values.