charts: networkPolicies.enabled turns off the bundled NetworkPolicies

charts/substrate/README.md

@@ -98,6 +98,7 @@ See `values.yaml` for the full set; the important keys:
 | `atelet.imageCredentialProviderBinDir` | `""` | Host path to the kubelet credential provider binaries; both paths are mounted read-only |
 | `credentialProvider.enabled` | `true` | Deploy the Kubernetes Secret provider and route `k8s.io` credential URIs to it. With no provider, every credential injection fails closed |
 | `credentialProvider.namespacePolicies` | `[]` | Default-deny atespace-to-namespace grants; the chart includes get-only Secret RBAC for the provider |
+| `networkPolicies.enabled` | `true` | Render the chart's NetworkPolicies (the release namespace's default deny and allow rules, and those of k8s-credential-provider and RustFS). Set `false` on a cluster that enforces its own policies, which must then admit the same flows |
 | `ateApi.actorJWTIssuer` | `https://<idp-service>.<namespace>.svc` | Issuer placed in actor JWTs; set a stable URL reachable by relying parties |
 | `objectStorePlugin.extraEnv` | `[]` | Object storage credentials/settings shared by both object-store plugins |
 | `objectStorePlugin.control.resources` / `objectStorePlugin.node.resources` | see `values.yaml` | Resources for the API and node object-store sidecars |

charts/substrate/templates/ate-system-networkpolicies.yaml

@@ -33,6 +33,7 @@
 #
 # Ports are named rather than numbered where the workloads name them, so the
 # policy follows the ports exposed by the chart workloads.
+{{- if .Values.networkPolicies.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -244,3 +245,4 @@ spec:
   - ports:
     - protocol: TCP
       port: https
+{{- end }}

charts/substrate/templates/k8s-credential-provider.yaml

@@ -173,6 +173,7 @@ metadata:
 data:
   namespace-policy.yaml: |
     policies: {{ toJson .Values.credentialProvider.namespacePolicies }}
+{{- if .Values.networkPolicies.enabled }}
 ---
 # Only the egress gateway may reach the provider's gRPC port; every other
 # connection to the provider pods is dropped. The provider also pins the
@@ -199,3 +200,4 @@ spec:
     - protocol: TCP
       port: 50051
 {{- end }}
+{{- end }}

charts/substrate/templates/rustfs.yaml

@@ -151,6 +151,7 @@ spec:
           done
           echo "timed out waiting for rustfs"
           exit 1
+{{- if .Values.networkPolicies.enabled }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -179,3 +180,4 @@ spec:
     - protocol: TCP
       port: api
 {{- end }}
+{{- end }}

charts/substrate/tests/control_plane_test.yaml

@@ -600,3 +600,38 @@ tests:
   asserts:
   - failedTemplate:
       errorMessage: "atenetEgress.extraCredentialProviders: vault.example.com needs an address as host:port"
+
+- it: renders the ate-system NetworkPolicies by default
+  template: ate-system-networkpolicies.yaml
+  asserts:
+  - containsDocument:
+      kind: NetworkPolicy
+      apiVersion: networking.k8s.io/v1
+
+- it: renders no ate-system NetworkPolicies when networkPolicies.enabled is false
+  template: ate-system-networkpolicies.yaml
+  set:
+    networkPolicies.enabled: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: renders no credential provider NetworkPolicy when networkPolicies.enabled is false
+  template: k8s-credential-provider.yaml
+  set:
+    networkPolicies.enabled: false
+  asserts:
+  - containsDocument:
+      kind: NetworkPolicy
+      apiVersion: networking.k8s.io/v1
+    not: true
+
+- it: renders no RustFS NetworkPolicy when networkPolicies.enabled is false
+  template: rustfs.yaml
+  set:
+    networkPolicies.enabled: false
+  asserts:
+  - containsDocument:
+      kind: NetworkPolicy
+      apiVersion: networking.k8s.io/v1
+    not: true

charts/substrate/values.yaml

@@ -202,6 +202,13 @@ credentialProvider:
       cpu: 500m
       memory: 256Mi
 
+# Render the chart's NetworkPolicies: the default deny and the allow rules for the
+# release namespace, and the policies of k8s-credential-provider and RustFS. A
+# cluster that enforces its own policies instead sets false and must admit the
+# same flows itself.
+networkPolicies:
+  enabled: true
+
 # Name of a ConfigMap in the release namespace that supplies per-environment
 # overrides for ate-api-server (ATE_API_POSTGRES_READ_WRITE_CONNECTION_STRING, ...).
 # Mounted via envFrom with optional=true. Created by the chart from these values.