feat: add monitoring virtualservices for alertmanager / prometheus

packages/standard/zarf.yaml

@@ -61,6 +61,12 @@ components:
     import:
       path: ../identity-authorization
 
+  # Authservice
+  - name: authservice
+    required: true
+    import:
+      path: ../identity-authorization
+
   # Neuvector
   - name: neuvector
     required: true
@@ -91,12 +97,6 @@ components:
     import:
       path: ../monitoring
 
-  # Authservice
-  - name: authservice
-    required: true
-    import:
-      path: ../identity-authorization
-
   # Velero
   - name: velero
     required: true

src/prometheus-stack/chart/templates/alertmanager-authz-policy.yaml

@@ -0,0 +1,25 @@
+# Copyright 2024 Defense Unicorns
+# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
+
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: monitoring-alertmanager-authz-policy
+  namespace: monitoring
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alertmanager
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - monitoring
+    to:
+    - operation:
+        methods:
+        - GET
+        - POST
+        paths:
+        - /*

src/prometheus-stack/chart/templates/alertmanager-internal-vs.yaml

@@ -0,0 +1,22 @@
+# Copyright 2024 Defense Unicorns
+# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
+
+apiVersion: networking.istio.io/v1
+kind: VirtualService
+metadata:
+  name: alertmanager-internal
+  namespace: monitoring
+spec:
+  hosts:
+    - kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local
+  http:
+    - route:
+      - destination:
+          host: kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local
+          port:
+            number: 9093
+      headers:
+        request:
+          set:
+            authorization: "internal-traffic"
+

src/prometheus-stack/chart/templates/prometheus-authz-policy.yaml

@@ -0,0 +1,27 @@
+# Copyright 2024 Defense Unicorns
+# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
+
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: monitoring-prometheus-authz-policy
+  namespace: monitoring
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        namespaces:
+        - monitoring
+        - grafana
+    to:
+    - operation:
+        methods:
+        - GET
+        - POST
+        paths:
+        - /*
+

src/prometheus-stack/chart/templates/prometheus-internal-vs.yaml

@@ -0,0 +1,22 @@
+# Copyright 2024 Defense Unicorns
+# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
+
+apiVersion: networking.istio.io/v1
+kind: VirtualService
+metadata:
+  name: prometheus-internal
+  namespace: monitoring
+spec:
+  hosts:
+    - kube-prometheus-stack-prometheus.monitoring.svc.cluster.local
+  http:
+    - route:
+      - destination:
+          host: kube-prometheus-stack-prometheus.monitoring.svc.cluster.local
+          port:
+            number: 9090
+      headers:
+        request:
+          set:
+            authorization: "internal-traffic"
+

src/prometheus-stack/chart/templates/uds-package.yaml

@@ -7,7 +7,44 @@ metadata:
   name: prometheus-stack
   namespace: {{ .Release.Namespace }}
 spec:
+  {{- if .Values.sso.enabled }}
+  sso:
+    - name: uds-prometheus
+      clientId: uds-prometheus
+      redirectUris:
+        - "https://metrics.admin.{{ .Values.domain }}/auth"
+      enableAuthserviceSelector:
+        app.kubernetes.io/name: prometheus
+        operator.prometheus.io/name: kube-prometheus-stack-prometheus
+      groups:
+        anyOf:
+          - /UDS Core/Admin
+          - /UDS Core/Auditor
+    - name: uds-alertmanager
+      clientId: uds-alertmanager
+      redirectUris:
+        - "https://alerts.admin.{{ .Values.domain }}/auth"
+      enableAuthserviceSelector:
+        app.kubernetes.io/name: alertmanager
+      groups:
+        anyOf:
+          - /UDS Core/Admin
+          - /UDS Core/Auditor
+  {{- end }}
   network:
+    expose:
+      - service: kube-prometheus-stack-alertmanager
+        selector:
+          app.kubernetes.io/name: alertmanager
+        host: alerts
+        gateway: admin
+        port: 9093
+      - service: kube-prometheus-stack-prometheus
+        selector:
+          app: prometheus
+        host: metrics
+        gateway: admin
+        port: 9090
     allow:
       # Permit intra-namespace communication
       - direction: Ingress
@@ -65,3 +102,18 @@ spec:
         port: 9090
         description: "Grafana Metrics Queries"
 
+      # Custom rules for unanticipated scenarios
+      {{- range .Values.custom }}
+      - direction: {{ .direction }}
+        selector:
+          {{ .selector | toYaml | nindent 10 }}
+        {{- if not .remoteGenerated }}
+        remoteNamespace: {{ .remoteNamespace }}
+        remoteSelector:
+          {{ .remoteSelector | toYaml | nindent 10 }}
+        port: {{ .port }}
+        {{- else }}
+        remoteGenerated: {{ .remoteGenerated }}
+        {{- end }}
+        description: {{ .description }}
+      {{- end }}

src/prometheus-stack/chart/values.yaml

@@ -1,2 +1,7 @@
 # Copyright 2024 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
+
+domain: "###ZARF_VAR_DOMAIN###"
+
+sso:
+  enabled: true

src/vector/chart/templates/uds-package.yaml

@@ -31,19 +31,3 @@ spec:
           app.kubernetes.io/name: loki
         port: 8080
         description: "Write Logs to Loki"
-
-      # Custom rules for additional networking access
-      {{- range .Values.additionalNetworkAllow }}
-      - direction: {{ .direction }}
-        selector:
-          {{ .selector | toYaml | nindent 10 }}
-        {{- if not .remoteGenerated }}
-        remoteNamespace: {{ .remoteNamespace }}
-        remoteSelector:
-          {{ .remoteSelector | toYaml | nindent 10 }}
-        port: {{ .port }}
-        {{- else }}
-        remoteGenerated: {{ .remoteGenerated }}
-        {{- end }}
-        description: {{ .description }}
-      {{- end }}