[bitnami/grafana-tempo] Network policy review

Apply the same changes made in PR bitnami#25519 to the Tempo chart Signed-off-by: Ben Foster <[email protected]>
bpfoster · May 15, 2024 · e825b76 · e825b76
1 parent 1ee381b
commit e825b76
Show file tree

Hide file tree

Showing 10 changed files with 299 additions and 222 deletions.
diff --git a/bitnami/grafana-tempo/Chart.yaml b/bitnami/grafana-tempo/Chart.yaml
@@ -39,4 +39,4 @@ maintainers:
 name: grafana-tempo
 sources:
 - https://github.com/bitnami/charts/tree/main/bitnami/grafana-tempo
-version: 3.2.0
+version: 3.3.0
diff --git a/bitnami/grafana-tempo/README.md b/bitnami/grafana-tempo/README.md
diff --git a/bitnami/grafana-tempo/templates/compactor/networkpolicy.yaml b/bitnami/grafana-tempo/templates/compactor/networkpolicy.yaml
@@ -100,21 +100,21 @@ spec:
         - port: {{ .Values.tempo.containerPorts.grpc }}
       {{- if not .Values.compactor.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.compactor.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.compactor.fullname" . }}-compactor: "true"
+        {{- end }}
+        {{- if .Values.compactor.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.compactor.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.compactor.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.compactor.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.compactor.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.compactor.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/distributor/networkpolicy.yaml b/bitnami/grafana-tempo/templates/distributor/networkpolicy.yaml
@@ -127,21 +127,21 @@ spec:
         {{- end }}
       {{- if not .Values.distributor.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.distributor.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.distributor.fullname" . }}-distributor: "true"
+        {{- end }}
+        {{- if .Values.distributor.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.distributor.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.distributor.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.distributor.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.distributor.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.distributor.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/ingester/networkpolicy.yaml b/bitnami/grafana-tempo/templates/ingester/networkpolicy.yaml
@@ -100,21 +100,21 @@ spec:
         - port: {{ .Values.tempo.containerPorts.grpc }}
       {{- if not .Values.ingester.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.ingester.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.ingester.fullname" . }}-ingester: "true"
+        {{- end }}
+        {{- if .Values.ingester.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.ingester.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.ingester.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.ingester.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.ingester.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.ingester.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/metrics-generator/networkpolicy.yaml b/bitnami/grafana-tempo/templates/metrics-generator/networkpolicy.yaml
@@ -100,21 +100,21 @@ spec:
         - port: {{ .Values.tempo.containerPorts.grpc }}
       {{- if not .Values.metricsGenerator.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.metricsGenerator.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.metrics-generator.fullname" . }}-metrics-generator: "true"
+        {{- end }}
+        {{- if .Values.metricsGenerator.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.metricsGenerator.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.metricsGenerator.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.metricsGenerator.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.metricsGenerator.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.metricsGenerator.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/querier/networkpolicy.yaml b/bitnami/grafana-tempo/templates/querier/networkpolicy.yaml
@@ -100,21 +100,21 @@ spec:
         - port: {{ .Values.tempo.containerPorts.grpc }}
       {{- if not .Values.querier.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.querier.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.querier.fullname" . }}-querier: "true"
+        {{- end }}
+        {{- if .Values.querier.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.querier.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.querier.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.querier.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.querier.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.querier.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/query-frontend/networkpolicy.yaml b/bitnami/grafana-tempo/templates/query-frontend/networkpolicy.yaml
@@ -110,21 +110,21 @@ spec:
         - port: {{ .Values.queryFrontend.query.containerPorts.jaegerMetrics }}
       {{- if not .Values.queryFrontend.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.queryFrontend.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.query-frontend.fullname" . }}-query-frontend: "true"
+        {{- end }}
+        {{- if .Values.queryFrontend.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.queryFrontend.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.queryFrontend.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.queryFrontend.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.queryFrontend.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.queryFrontend.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}

diff --git a/bitnami/grafana-tempo/templates/vulture/networkpolicy.yaml b/bitnami/grafana-tempo/templates/vulture/networkpolicy.yaml
@@ -98,21 +98,21 @@ spec:
         - port: {{ .Values.vulture.containerPorts.http }}
       {{- if not .Values.vulture.networkPolicy.allowExternal }}
       from:
+        {{- if .Values.vulture.networkPolicy.addExternalClientAccess }}
         - podSelector:
             matchLabels:
               {{ template "grafana-tempo.vulture.fullname" . }}-vulture: "true"
+        {{- end }}
+        {{- if .Values.vulture.networkPolicy.ingressPodMatchLabels }}
+        - podSelector:
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.vulture.networkPolicy.ingressPodMatchLabels "context" $ ) | nindent 14 }}
+        {{- end }}
         {{- if .Values.vulture.networkPolicy.ingressNSMatchLabels }}
         - namespaceSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.vulture.networkPolicy.ingressNSMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSMatchLabels "context" $ ) | nindent 14 }}
           {{- if .Values.vulture.networkPolicy.ingressNSPodMatchLabels }}
           podSelector:
-            matchLabels:
-              {{- range $key, $value := .Values.vulture.networkPolicy.ingressNSPodMatchLabels }}
-              {{ $key | quote }}: {{ $value | quote }}
-              {{- end }}
+            matchLabels: {{- include "common.tplvalues.render" (dict "value" $ingressNSPodMatchLabels "context" $ ) | nindent 14 }}
           {{- end }}
         {{- end }}
       {{- end }}