Add initial support for network policies #151
Conversation
Signed-off-by: Donald Sebastian Leung <[email protected]>
kind and Prometheus configurationOpenCost Helm installation with default configurationOpenCost Helm installation with NetworkPolicies enabled |
|
I propose let's keep this simple and we can refine the NetworkPolicy configuration options in future issues / PRs. |
charts/opencost/README.md
Outdated
| | networkPolicies.enabled | bool | `false` | Whether network policies should be created | | ||
| | networkPolicies.prometheus.namespace | string | `"prometheus-system"` | Namespace where internal Prometheus is installed | | ||
| | networkPolicies.prometheus.labels | object | `{ "app.kubernetes.io/name": "prometheus" }` | Label\(s\) used to identify the server Pod\(s\) relating to the internal Prometheus | |
There was a problem hiding this comment.
Would like to mention that I found the current formatting of this Markdown table very distracting and difficult to work with both in Vim and VS Code.
Feel free to go ahead and fix the formatting on my behalf to match the other rows, or suggest a tool which can format the table automatically.
charts/opencost/README.md
Outdated
| | opencost.prometheus.internal.namespaceName | string | `"prometheus-system"` | Namespace of in-cluster Prometheus | | ||
| | opencost.prometheus.internal.podPort | int | `9090` | Pod port of in-cluster Prometheus | | ||
| | opencost.prometheus.internal.serviceName | string | `"prometheus-server"` | Service name of in-cluster Prometheus | | ||
| | opencost.prometheus.internal.servicePort | int | `80` | Service port of in-cluster Prometheus | |
There was a problem hiding this comment.
I took the liberty to change the defaults for these values, since the original defaults don't work with the Prometheus Helm chart which I assume is one of the most common methods of deploying Prometheus on Kubernetes. In particular, the Prometheus Helm chart names the Prometheus service as ${RELEASE_NAME}-server which the original default value of my-prometheus will never match.
With the new defaults, the OpenCost Helm chart will work out of the box without any customized configuration if Prometheus is installed via the Helm chart with the following parameters:
- Release name:
prometheus - Release namespace:
prometheus-system
charts/opencost/values.yaml
Outdated
| # NetworkPolicies for ingress | ||
| networkPolicies: | ||
| # -- Specifies whether networkpolicies should be created | ||
| enabled: false | ||
|
|
||
| # -- Internal Prometheus settings related to NetworkPolicies | ||
| prometheus: | ||
| # -- Namespace where internal Prometheus is installed | ||
| namespace: prometheus-system | ||
| # -- Labels applied to the Prometheus server pod(s) | ||
| labels: | ||
| app.kubernetes.io/name: prometheus | ||
|
|
There was a problem hiding this comment.
Again, these defaults are designed to work out of the box with the Prometheus Helm chart installed as release prometheus in namespace prometheus-system.
charts/opencost/values.yaml
Outdated
| serviceName: prometheus-server | ||
| # -- Namespace of in-cluster Prometheus | ||
| namespaceName: opencost | ||
| namespaceName: prometheus-system | ||
| # -- Service port of in-cluster Prometheus | ||
| port: 9090 | ||
| servicePort: 80 | ||
| # -- Pod port of in-cluster Prometheus | ||
| podPort: 9090 |
There was a problem hiding this comment.
Ditto (OOTB with Prometheus Helm chart)
Signed-off-by: Donald Sebastian Leung <[email protected]>
|
Just made the following changes to the Helm chart configuration:
Rationale:
Rest assured I tested the latest changes against both the default configuration and with network policies enabled, but feel free to verify the results independently. |
* Fixes Issue #21 Signed-off-by: Donald Sebastian Leung <[email protected]> * Refine Helm chart configuration to maintain backwards compatibility Signed-off-by: Donald Sebastian Leung <[email protected]> * Version bump Signed-off-by: Matt Ray <[email protected]> --------- Signed-off-by: Donald Sebastian Leung <[email protected]> Signed-off-by: Matt Ray <[email protected]> Co-authored-by: Donald Sebastian Leung <[email protected]>
|
Merged in #155 Thanks @DonaldKellett! |
What does this PR change?
This PR introduces initial support for network policies
Does this PR relate to any other PRs?
Inspired by #56
How will this PR impact users?
Adds the ability to enable network policies simply by setting the field
networkPolicies.enabledtotrueDoes this PR address any GitHub or Zendesk issues?
Closes #21
How was this PR tested?
v0.20.0v1.27.3v3.13.2Internal Prometheus
https://prometheus-community.github.io/helm-chartsprometheusprometheusprometheus-systemOpenCost configuration
charts/opencost/values.yamlnetworkPolicies.enabledset totrueDoes this PR require changes to documentation?
Included within the PR, please review
Have you labeled this PR and its corresponding Issue as "next release" if it should be part of the next OpenCost release? If not, why not?
Not applicable to this Helm chart repository, I believe?