Skip to content

Commit 3f16856

Browse files
ashish1099ashish1099
authored
Merge pull request #91 from Obmondo/feat/openobserve-cilium-netpol
feat: Add Cilium network policies for OpenObserve
2 parents de89424 + 50a2975 commit 3f16856

9 files changed

Lines changed: 544 additions & 12 deletions

‎argocd-helm-charts/kubeaid-addons/README.md‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ here rather than being scattered across individual application charts.
1717
| Argo CD baseline policy | `CiliumNetworkPolicy` | `global.netpol.enabled` + `global.argocd.netpol` |
1818
| Harbor network policies | `CiliumNetworkPolicy` | `global.netpol.enabled` + `global.harbor.netpol` |
1919
| SonarQube network policy | `CiliumNetworkPolicy` | `global.netpol.enabled` + `global.sonarqube.netpol` |
20+
| OpenObserve network policy | `CiliumNetworkPolicy` | `global.netpol.enabled` + `global.openobserve` |
2021

2122
Everything is **nil-safe** - if a key is missing from values, the template renders nothing rather
2223
than panicking. New operator types (MariaDB, MongoDB, etc.) can be added by dropping a new
@@ -176,10 +177,27 @@ global:
176177
harbor:
177178
netpol: true
178179
sonarqube:
179-
netpol: true
180+
netpol: true
181+
openobserve:
182+
netpol: true
183+
postgres:
184+
cnpgCluster: openobserve-postgres
185+
ingestors:
186+
- name: collector
187+
namespace: openobserve
188+
labels:
189+
app.kubernetes.io/name: openobserve-collector
190+
azure:
191+
enabled: true
192+
openfga:
193+
enabled: true
180194
```
181195

182-
Argo CD baseline policy is configured under **`global.argocd`** plus shared **`global.netpol.traefik`** / **`global.netpol.prometheus`** (same pattern as whoami/oncall). Render it via a parent chart (for example `argo-cd`) that includes `kubeaid-addons` as a dependency; Helm only passes `global` into subcharts.
196+
**OpenObserve** (`networkpolicy-openobserve*.yaml`) renders policies across separate template files: core workloads (`networkpolicy-openobserve.yaml`), ingestor egress (`networkpolicy-openobserve-ingestor.yaml`), OpenFGA, NATS, CNPG postgres, and OpenTelemetry operator. Postgres is provisioned by the openobserve chart, not kubeaid-addons — set `global.openobserve.postgres.cnpgCluster` if the cluster name differs, and do not enable `global.postgresql.enabled` for OpenObserve.
197+
198+
Policies are rendered by the **`openobserve` parent chart**, which includes `kubeaid-addons` as a Helm dependency (`openobserve/Chart.yaml` + `charts/kubeaid-addons` symlink — same pattern as `harbor` / `sonarqube`). Enable them from the OpenObserve Argo CD app values via `global.netpol.enabled` and `global.openobserve.netpol`. Default-deny for the namespace still comes from the standalone `kubeaid-addons` Argo app (§1).
199+
200+
Argo CD baseline policy is configured under **`global.argocd`** plus shared **`global.netpol.traefik`** / **`global.netpol.prometheus`**. Render it via a parent chart (for example `argo-cd`) that includes `kubeaid-addons` as a dependency; Helm only passes `global` into subcharts.
183201

184202
```yaml
185203
global:

‎argocd-helm-charts/kubeaid-addons/charts/network-policies/templates/networkpolicy-openobserve-ingestor.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{- if and ((.Values.global).netpol).enabled ((.Values.global).openobserve).netpol }}
2+
{{- range $index, $ingestor := (.Values.global.openobserve.ingestors | default list) }}
3+
---
4+
# Ingestor egress (e.g. OpenTelemetry collector → OpenObserve router)
5+
apiVersion: cilium.io/v2
6+
kind: CiliumNetworkPolicy
7+
metadata:
8+
name: {{ $.Values.global.netpol.releaseName | default $.Release.Name }}-ingestor-{{ $ingestor.name | default $index }}-networkpolicy
9+
namespace: {{ $.Release.Namespace }}
10+
labels:
11+
app.kubernetes.io/component: cilium-networkpolicy
12+
spec:
13+
endpointSelector:
14+
matchLabels:
15+
{{- range $key, $value := ($ingestor.labels | default dict) }}
16+
{{ $key }}: {{ $value | quote }}
17+
{{- end }}
18+
19+
egress:
20+
- toEndpoints:
21+
- matchLabels:
22+
k8s:io.kubernetes.pod.namespace: {{ $.Release.Namespace }}
23+
app.kubernetes.io/name: openobserve
24+
app.kubernetes.io/instance: {{ $.Values.global.netpol.releaseName | default $.Release.Name }}
25+
toPorts:
26+
- ports:
27+
- port: {{ $.Values.global.openobserve.httpPort | default "5080" | quote }}
28+
protocol: TCP
29+
- port: {{ $.Values.global.openobserve.grpcPort | default "5081" | quote }}
30+
protocol: TCP
31+
{{- if (($ingestor).allowTraefikEgress) }}
32+
- toEndpoints:
33+
- matchLabels:
34+
k8s:io.kubernetes.pod.namespace: {{ $.Values.global.netpol.traefik.namespace }}
35+
{{- range $key, $value := ($.Values.global.netpol.traefik.labels | default dict) }}
36+
{{ $key }}: {{ $value | quote }}
37+
{{- end }}
38+
toPorts:
39+
- ports:
40+
- port: "443"
41+
protocol: TCP
42+
{{- end }}
43+
- toEntities:
44+
- kube-apiserver
45+
toPorts:
46+
- ports:
47+
- port: "443"
48+
protocol: TCP
49+
- port: "6443"
50+
protocol: TCP
51+
{{- end }}
52+
{{- end }}

‎argocd-helm-charts/kubeaid-addons/charts/network-policies/templates/networkpolicy-openobserve-nats.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{- if and ((.Values.global).netpol).enabled ((.Values.global).openobserve).netpol ((.Values.global.openobserve.nats).enabled) }}
2+
---
3+
# NATS
4+
apiVersion: cilium.io/v2
5+
kind: CiliumNetworkPolicy
6+
metadata:
7+
name: {{ .Values.global.netpol.releaseName | default .Release.Name }}-nats-networkpolicy
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
app.kubernetes.io/component: cilium-networkpolicy
11+
spec:
12+
endpointSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: nats
15+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name | quote }}
16+
17+
ingress:
18+
- fromEndpoints:
19+
- matchLabels:
20+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
21+
app.kubernetes.io/name: openobserve
22+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name }}
23+
toPorts:
24+
- ports:
25+
- port: {{ .Values.global.openobserve.nats.port | default "4222" | quote }}
26+
protocol: TCP
27+
- fromEndpoints:
28+
- matchLabels:
29+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
30+
app.kubernetes.io/name: nats
31+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name | quote }}
32+
toPorts:
33+
- ports:
34+
- port: {{ .Values.global.openobserve.nats.port | default "4222" | quote }}
35+
protocol: TCP
36+
- port: "6222"
37+
protocol: TCP
38+
39+
egress:
40+
- toEndpoints:
41+
- matchLabels:
42+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
43+
app.kubernetes.io/name: nats
44+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name | quote }}
45+
toPorts:
46+
- ports:
47+
- port: {{ .Values.global.openobserve.nats.port | default "4222" | quote }}
48+
protocol: TCP
49+
- port: "6222"
50+
protocol: TCP
51+
{{- end }}

‎argocd-helm-charts/kubeaid-addons/charts/network-policies/templates/networkpolicy-openobserve-openfga.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{{- if and ((.Values.global).netpol).enabled ((.Values.global).openobserve).netpol ((.Values.global.openobserve.openfga).enabled) }}
2+
---
3+
# OpenFGA (separate pod labels: app=openfga)
4+
apiVersion: cilium.io/v2
5+
kind: CiliumNetworkPolicy
6+
metadata:
7+
name: {{ .Values.global.netpol.releaseName | default .Release.Name }}-openfga-networkpolicy
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
app.kubernetes.io/component: cilium-networkpolicy
11+
spec:
12+
endpointSelector:
13+
matchLabels:
14+
app: openfga
15+
16+
ingress:
17+
- fromEndpoints:
18+
- matchLabels:
19+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
20+
app.kubernetes.io/name: openobserve
21+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name }}
22+
toPorts:
23+
- ports:
24+
- port: {{ .Values.global.openobserve.openfga.httpPort | default "8080" | quote }}
25+
protocol: TCP
26+
- port: {{ .Values.global.openobserve.openfga.grpcPort | default "8081" | quote }}
27+
protocol: TCP
28+
29+
egress:
30+
- toEndpoints:
31+
- matchLabels:
32+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
33+
cnpg.io/cluster: {{ .Values.global.openobserve.postgres.cnpgCluster | default (printf "%s-postgres" (.Values.global.netpol.releaseName | default .Release.Name)) | quote }}
34+
toPorts:
35+
- ports:
36+
- port: "5432"
37+
protocol: TCP
38+
{{- end }}

‎argocd-helm-charts/kubeaid-addons/charts/network-policies/templates/networkpolicy-openobserve-opentelemetry-operator.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{{- if and ((.Values.global).netpol).enabled ((.Values.global).openobserve).netpol ((.Values.global.openobserve.opentelemetryOperator).enabled) }}
2+
---
3+
# OpenTelemetry Operator (admission webhooks + controller; separate Argo app, same namespace)
4+
apiVersion: cilium.io/v2
5+
kind: CiliumNetworkPolicy
6+
metadata:
7+
name: {{ .Values.global.netpol.releaseName | default .Release.Name }}-opentelemetry-operator-networkpolicy
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
app.kubernetes.io/component: cilium-networkpolicy
11+
spec:
12+
endpointSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: opentelemetry-operator
15+
app.kubernetes.io/instance: {{ .Values.global.openobserve.opentelemetryOperator.instance | default "opentelemetry-operator" | quote }}
16+
17+
ingress:
18+
# Kubernetes API server → mutating/validating webhooks
19+
- fromEntities:
20+
- kube-apiserver
21+
toPorts:
22+
- ports:
23+
- port: {{ .Values.global.openobserve.opentelemetryOperator.webhookPort | default "9443" | quote }}
24+
protocol: TCP
25+
- port: {{ .Values.global.openobserve.opentelemetryOperator.metricsPort | default "8443" | quote }}
26+
protocol: TCP
27+
28+
egress:
29+
- toEntities:
30+
- kube-apiserver
31+
toPorts:
32+
- ports:
33+
- port: "443"
34+
protocol: TCP
35+
- port: "6443"
36+
protocol: TCP
37+
{{- end }}

‎argocd-helm-charts/kubeaid-addons/charts/network-policies/templates/networkpolicy-openobserve-postgres.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{- if and ((.Values.global).netpol).enabled ((.Values.global).openobserve).netpol }}
2+
---
3+
# CNPG postgres (provisioned by openobserve chart, not kubeaid-addons postgresql operator)
4+
apiVersion: cilium.io/v2
5+
kind: CiliumNetworkPolicy
6+
metadata:
7+
name: {{ .Values.global.netpol.releaseName | default .Release.Name }}-postgres-networkpolicy
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
app.kubernetes.io/component: cilium-networkpolicy
11+
spec:
12+
endpointSelector:
13+
matchLabels:
14+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
15+
cnpg.io/cluster: {{ .Values.global.openobserve.postgres.cnpgCluster | default (printf "%s-postgres" (.Values.global.netpol.releaseName | default .Release.Name)) | quote }}
16+
17+
ingress:
18+
- fromEndpoints:
19+
- matchLabels:
20+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
21+
app.kubernetes.io/name: openobserve
22+
app.kubernetes.io/instance: {{ .Values.global.netpol.releaseName | default .Release.Name }}
23+
toPorts:
24+
- ports:
25+
- port: "5432"
26+
protocol: TCP
27+
{{- if ((.Values.global.openobserve.openfga).enabled) }}
28+
- fromEndpoints:
29+
- matchLabels:
30+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
31+
app: openfga
32+
toPorts:
33+
- ports:
34+
- port: "5432"
35+
protocol: TCP
36+
{{- end }}
37+
{{- if ((.Values.global.openobserve.postgres).cnpgOperator).enabled }}
38+
- fromEndpoints:
39+
- matchLabels:
40+
k8s:io.kubernetes.pod.namespace: {{ .Values.global.openobserve.postgres.cnpgOperator.namespace | default "cloudnative-pg" | quote }}
41+
{{- range $key, $value := (.Values.global.openobserve.postgres.cnpgOperator.labels | default dict) }}
42+
{{ $key }}: {{ $value | quote }}
43+
{{- end }}
44+
toPorts:
45+
- ports:
46+
- port: "5432"
47+
protocol: TCP
48+
- port: "8000"
49+
protocol: TCP
50+
{{- end }}
51+
- fromEndpoints:
52+
- matchLabels:
53+
k8s:io.kubernetes.pod.namespace: {{ .Release.Namespace }}
54+
cnpg.io/cluster: {{ .Values.global.openobserve.postgres.cnpgCluster | default (printf "%s-postgres" (.Values.global.netpol.releaseName | default .Release.Name)) | quote }}
55+
toPorts:
56+
- ports:
57+
- port: "5432"
58+
protocol: TCP
59+
- port: "8000"
60+
protocol: TCP
61+
{{- end }}

0 commit comments

Comments
 (0)