Revert "Add Egress Helm-toolkit function & enforce the nework policy at OSH-INFRA"
This reverts commit 8d33a2911c
.
Change-Id: Ic861b9bf9b337449b47a3558da8355e7a5bcacee
This commit is contained in:
parent
8d33a2911c
commit
0bf3674539
@ -1,21 +0,0 @@
|
|||||||
{{/*
|
|
||||||
Copyright 2017-2018 The Openstack-Helm Authors.
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/}}
|
|
||||||
{{- if .Values.manifests.network_policy -}}
|
|
||||||
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "ceph-rgw" -}}
|
|
||||||
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
|
||||||
{{- $netpol_opts := dict "envAll" . "name" "application" "label" "ceph" }}
|
|
||||||
{{ $netpol_opts | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
|
||||||
{{- end -}}
|
|
@ -474,18 +474,6 @@ endpoints:
|
|||||||
mon:
|
mon:
|
||||||
default: 6789
|
default: 6789
|
||||||
|
|
||||||
network_policy:
|
|
||||||
ceph-rgw:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
ceph:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
|
|
||||||
manifests:
|
manifests:
|
||||||
configmap_ceph_templates: true
|
configmap_ceph_templates: true
|
||||||
@ -495,7 +483,6 @@ manifests:
|
|||||||
configmap_etc: true
|
configmap_etc: true
|
||||||
deployment_rgw: true
|
deployment_rgw: true
|
||||||
ingress_rgw: true
|
ingress_rgw: true
|
||||||
network_policy: false
|
|
||||||
job_ceph_rgw_storage_init: true
|
job_ceph_rgw_storage_init: true
|
||||||
job_image_repo_sync: true
|
job_image_repo_sync: true
|
||||||
job_ks_endpoints: true
|
job_ks_endpoints: true
|
||||||
|
@ -586,21 +586,6 @@ endpoints:
|
|||||||
api:
|
api:
|
||||||
default: 8088
|
default: 8088
|
||||||
public: 80
|
public: 80
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
monitoring:
|
monitoring:
|
||||||
prometheus:
|
prometheus:
|
||||||
@ -621,13 +606,6 @@ network:
|
|||||||
enabled: false
|
enabled: false
|
||||||
port: 30920
|
port: 30920
|
||||||
|
|
||||||
network_policy:
|
|
||||||
elasticsearch:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
storage:
|
storage:
|
||||||
enabled: true
|
enabled: true
|
||||||
pvc:
|
pvc:
|
||||||
@ -645,7 +623,6 @@ manifests:
|
|||||||
deployment_client: true
|
deployment_client: true
|
||||||
deployment_master: true
|
deployment_master: true
|
||||||
ingress: true
|
ingress: true
|
||||||
network_policy: false
|
|
||||||
job_image_repo_sync: true
|
job_image_repo_sync: true
|
||||||
job_snapshot_repository: true
|
job_snapshot_repository: true
|
||||||
job_s3_user: true
|
job_s3_user: true
|
||||||
|
@ -481,43 +481,6 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
metrics:
|
metrics:
|
||||||
default: 9309
|
default: 9309
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
|
||||||
fluentbit:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
fluentd:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
fluent:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
fluent-logging:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
monitoring:
|
monitoring:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
@ -232,26 +232,6 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
ldap:
|
ldap:
|
||||||
default: 389
|
default: 389
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
|
||||||
grafana:
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
dependencies:
|
dependencies:
|
||||||
dynamic:
|
dynamic:
|
||||||
|
@ -11,28 +11,12 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|||||||
See the License for the specific language governing permissions and
|
See the License for the specific language governing permissions and
|
||||||
limitations under the License.
|
limitations under the License.
|
||||||
*/}}
|
*/}}
|
||||||
|
|
||||||
{{/*
|
{{/*
|
||||||
abstract: |
|
abstract: |
|
||||||
Creates a network policy manifest for services.
|
Creates a network policy manifest for services.
|
||||||
values: |
|
values: |
|
||||||
endpoints:
|
network_policy:
|
||||||
kube_dns:
|
|
||||||
namespace: kube-system
|
|
||||||
name: kubernetes-dns
|
|
||||||
hosts:
|
|
||||||
default: kube-dns
|
|
||||||
host_fqdn_override:
|
|
||||||
default: null
|
|
||||||
path:
|
|
||||||
default: null
|
|
||||||
scheme: http
|
|
||||||
port:
|
|
||||||
dns_tcp:
|
|
||||||
default: 53
|
|
||||||
dns:
|
|
||||||
default: 53
|
|
||||||
protocol: UDP
|
|
||||||
network_policy:
|
|
||||||
myLabel:
|
myLabel:
|
||||||
ingress:
|
ingress:
|
||||||
- from:
|
- from:
|
||||||
@ -42,14 +26,6 @@ network_policy:
|
|||||||
ports:
|
ports:
|
||||||
- protocol: TCP
|
- protocol: TCP
|
||||||
port: 80
|
port: 80
|
||||||
egress:
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: default
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: kube-public
|
|
||||||
usage: |
|
usage: |
|
||||||
{{ dict "envAll" . "name" "application" "label" "myLabel" | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
{{ dict "envAll" . "name" "application" "label" "myLabel" | include "helm-toolkit.manifests.kubernetes_network_policy" }}
|
||||||
return: |
|
return: |
|
||||||
@ -75,25 +51,7 @@ return: |
|
|||||||
- protocol: TCP
|
- protocol: TCP
|
||||||
port: 80
|
port: 80
|
||||||
egress:
|
egress:
|
||||||
- to:
|
- {}
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
application: kube-dns
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: kube-system
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 53
|
|
||||||
- protocol: UDP
|
|
||||||
port: 53
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: kube-public
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: default
|
|
||||||
*/}}
|
*/}}
|
||||||
|
|
||||||
{{- define "helm-toolkit.manifests.kubernetes_network_policy" -}}
|
{{- define "helm-toolkit.manifests.kubernetes_network_policy" -}}
|
||||||
@ -118,47 +76,8 @@ spec:
|
|||||||
matchLabels:
|
matchLabels:
|
||||||
{{ $name }}: {{ $label }}
|
{{ $name }}: {{ $label }}
|
||||||
egress:
|
egress:
|
||||||
{{- range $key, $value := $envAll.Values.endpoints }}
|
- {}
|
||||||
{{- if kindIs "map" $value }}
|
|
||||||
- to:
|
|
||||||
{{- if index $value "namespace" }}
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: {{ index $value "namespace" }}
|
|
||||||
{{- else if index $value "hosts" }}
|
|
||||||
{{- $defaultValue := index $value "hosts" "internal" }}
|
|
||||||
{{- if hasKey (index $value "hosts") "internal" }}
|
|
||||||
{{- $a := split "-" $defaultValue }}
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
application: {{ printf "%s" (index $a._0) | default $defaultValue }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $defaultValue := index $value "hosts" "default" }}
|
|
||||||
{{- $a := split "-" $defaultValue }}
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
application: {{ printf "%s" (index $a._0) | default $defaultValue }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
ports:
|
|
||||||
{{- if index $value "port" }}
|
|
||||||
{{- range $k, $v := index $value "port" }}
|
|
||||||
{{- if $k }}
|
|
||||||
{{- range $pk, $pv := $v }}
|
|
||||||
{{- if (ne $pk "protocol") }}
|
|
||||||
- port: {{ $pv }}
|
|
||||||
protocol: {{ $v.protocol | default "TCP" }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if hasKey (index $envAll.Values "network_policy") $label }}
|
{{- if hasKey (index $envAll.Values "network_policy") $label }}
|
||||||
{{- if index $envAll.Values.network_policy $label "egress" }}
|
|
||||||
{{ index $envAll.Values.network_policy $label "egress" | toYaml | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if index $envAll.Values.network_policy $label "ingress" }}
|
{{- if index $envAll.Values.network_policy $label "ingress" }}
|
||||||
ingress:
|
ingress:
|
||||||
{{ index $envAll.Values.network_policy $label "ingress" | toYaml | indent 4 }}
|
{{ index $envAll.Values.network_policy $label "ingress" | toYaml | indent 4 }}
|
||||||
|
@ -198,28 +198,11 @@ endpoints:
|
|||||||
dns:
|
dns:
|
||||||
default: 53
|
default: 53
|
||||||
protocol: UDP
|
protocol: UDP
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
ingress:
|
ingress:
|
||||||
ingress:
|
ingress:
|
||||||
- {}
|
- {}
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
conf:
|
conf:
|
||||||
controller:
|
controller:
|
||||||
|
@ -294,26 +294,7 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
ldap:
|
ldap:
|
||||||
default: 389
|
default: 389
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
|
||||||
kibana:
|
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
network:
|
network:
|
||||||
kibana:
|
kibana:
|
||||||
ingress:
|
ingress:
|
||||||
|
@ -146,28 +146,11 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
ldap:
|
ldap:
|
||||||
default: 389
|
default: 389
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
ldap:
|
ldap:
|
||||||
ingress:
|
ingress:
|
||||||
- {}
|
- {}
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
data:
|
data:
|
||||||
sample: |
|
sample: |
|
||||||
|
@ -57,26 +57,11 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
registry:
|
registry:
|
||||||
node: 5000
|
node: 5000
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
libvirt:
|
libvirt:
|
||||||
ingress:
|
ingress:
|
||||||
- {}
|
- {}
|
||||||
egress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
ceph_client:
|
ceph_client:
|
||||||
configmap: ceph-etc
|
configmap: ceph-etc
|
||||||
|
@ -275,21 +275,6 @@ endpoints:
|
|||||||
dns:
|
dns:
|
||||||
default: 53
|
default: 53
|
||||||
protocol: UDP
|
protocol: UDP
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
mariadb:
|
mariadb:
|
||||||
|
@ -98,21 +98,6 @@ endpoints:
|
|||||||
dns:
|
dns:
|
||||||
default: 53
|
default: 53
|
||||||
protocol: UDP
|
protocol: UDP
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
memcached:
|
memcached:
|
||||||
|
@ -168,21 +168,6 @@ endpoints:
|
|||||||
default: 9283
|
default: 9283
|
||||||
scheme:
|
scheme:
|
||||||
default: http
|
default: http
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network:
|
network:
|
||||||
nagios:
|
nagios:
|
||||||
|
@ -90,19 +90,6 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
registry:
|
registry:
|
||||||
node: 5000
|
node: 5000
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
openvswitch:
|
openvswitch:
|
||||||
|
@ -198,32 +198,10 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
metrics:
|
metrics:
|
||||||
default: 9187
|
default: 9187
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
|
||||||
postgresql:
|
|
||||||
ingress:
|
|
||||||
- {}
|
|
||||||
|
|
||||||
|
|
||||||
manifests:
|
manifests:
|
||||||
configmap_bin: true
|
configmap_bin: true
|
||||||
job_image_repo_sync: true
|
job_image_repo_sync: true
|
||||||
network_policy: false
|
|
||||||
secret_admin: true
|
secret_admin: true
|
||||||
service: true
|
service: true
|
||||||
statefulset: true
|
statefulset: true
|
||||||
|
@ -167,21 +167,6 @@ endpoints:
|
|||||||
port:
|
port:
|
||||||
ldap:
|
ldap:
|
||||||
default: 389
|
default: 389
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
dependencies:
|
dependencies:
|
||||||
dynamic:
|
dynamic:
|
||||||
|
@ -265,21 +265,6 @@ endpoints:
|
|||||||
dns:
|
dns:
|
||||||
default: 53
|
default: 53
|
||||||
protocol: UDP
|
protocol: UDP
|
||||||
#NOTE(tp6510): these endpoints allow for things like DNS lookups and apiserver access.
|
|
||||||
# They are using to enable the Egress K8s network policy.
|
|
||||||
k8s:
|
|
||||||
port:
|
|
||||||
api:
|
|
||||||
default: 6443
|
|
||||||
internal: 5000
|
|
||||||
http:
|
|
||||||
default: 80
|
|
||||||
default:
|
|
||||||
namespace: default
|
|
||||||
kube_system:
|
|
||||||
namespace: kube-system
|
|
||||||
kube_public:
|
|
||||||
namespace: kube-public
|
|
||||||
|
|
||||||
network_policy:
|
network_policy:
|
||||||
rabbitmq:
|
rabbitmq:
|
||||||
|
@ -23,29 +23,28 @@ tee /tmp/ldap.yaml <<EOF
|
|||||||
manifests:
|
manifests:
|
||||||
network_policy: true
|
network_policy: true
|
||||||
network_policy:
|
network_policy:
|
||||||
ldap:
|
ingress:
|
||||||
ingress:
|
- from:
|
||||||
- from:
|
- podSelector:
|
||||||
- podSelector:
|
matchLabels:
|
||||||
matchLabels:
|
application: ldap
|
||||||
application: ldap
|
- podSelector:
|
||||||
- podSelector:
|
matchLabels:
|
||||||
matchLabels:
|
application: grafana
|
||||||
application: grafana
|
- podSelector:
|
||||||
- podSelector:
|
matchLabels:
|
||||||
matchLabels:
|
application: nagios
|
||||||
application: nagios
|
- podSelector:
|
||||||
- podSelector:
|
matchLabels:
|
||||||
matchLabels:
|
application: elasticsearch
|
||||||
application: elasticsearch
|
- podSelector:
|
||||||
- podSelector:
|
matchLabels:
|
||||||
matchLabels:
|
application: kibana
|
||||||
application: kibana
|
ports:
|
||||||
ports:
|
- protocol: TCP
|
||||||
- protocol: TCP
|
port: 389
|
||||||
port: 389
|
- protocol: TCP
|
||||||
- protocol: TCP
|
port: 80
|
||||||
port: 80
|
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
#NOTE: Deploy command
|
#NOTE: Deploy command
|
||||||
|
@ -39,11 +39,6 @@ network_policy:
|
|||||||
port: 4567
|
port: 4567
|
||||||
- protocol: TCP
|
- protocol: TCP
|
||||||
port: 80
|
port: 80
|
||||||
egress:
|
|
||||||
- from:
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
application: ingress
|
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
#NOTE: Deploy command
|
#NOTE: Deploy command
|
||||||
|
@ -28,11 +28,16 @@ pod:
|
|||||||
replicas:
|
replicas:
|
||||||
data: 1
|
data: 1
|
||||||
master: 2
|
master: 2
|
||||||
|
manifests:
|
||||||
|
network_policy: true
|
||||||
|
network_policy:
|
||||||
|
elasticsearch:
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
helm upgrade --install elasticsearch ./elasticsearch \
|
helm upgrade --install elasticsearch ./elasticsearch \
|
||||||
--namespace=osh-infra \
|
--namespace=osh-infra \
|
||||||
--set manifests.network_policy=true \
|
|
||||||
--values=/tmp/elasticsearch.yaml
|
--values=/tmp/elasticsearch.yaml
|
||||||
|
|
||||||
#NOTE: Wait for deploy
|
#NOTE: Wait for deploy
|
||||||
|
@ -19,10 +19,29 @@ set -xe
|
|||||||
#NOTE: Lint and package chart
|
#NOTE: Lint and package chart
|
||||||
make fluent-logging
|
make fluent-logging
|
||||||
|
|
||||||
|
tee /tmp/fluent-logging.yaml <<EOF
|
||||||
|
manifests:
|
||||||
|
network_policy: true
|
||||||
|
network_policy:
|
||||||
|
fluentbit:
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
fluentd:
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
fluent:
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
fluent-logging:
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
#NOTE: Deploy command
|
#NOTE: Deploy command
|
||||||
helm upgrade --install fluent-logging ./fluent-logging \
|
helm upgrade --install fluent-logging ./fluent-logging \
|
||||||
--namespace=osh-infra \
|
--namespace=osh-infra \
|
||||||
--set manifests.network_policy=true \
|
--values=/tmp/fluent-logging.yaml \
|
||||||
--set pod.replicas.fluentd=1
|
--set pod.replicas.fluentd=1
|
||||||
|
|
||||||
#NOTE: Wait for deploy
|
#NOTE: Wait for deploy
|
||||||
|
Loading…
Reference in New Issue
Block a user