Merge branch '311-dynamic-network-policy' into 'main'

Enable Dynamic Network Policy

See merge request !372

CHANGELOG.md

@@ -4,6 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ---
 
+
+## [8.9.1-bb.1] (2025-03-06)
+
+### Changed
+
+- Added configuration for dynamic network policy support
+
 ## [8.9.1-bb.0] (2025-02-28)
 
 ### Changed

README.md

 <!-- Warning: Do not manually edit this file. See notes on gluon + helm-docs at the end of this file for more information. -->
 # gitlab
 
-![Version: 8.9.1-bb.0](https://img.shields.io/badge/Version-8.9.1--bb.0-informational?style=flat-square) ![AppVersion: v17.9.1](https://img.shields.io/badge/AppVersion-v17.9.1-informational?style=flat-square) ![Maintenance Track: bb_integrated](https://img.shields.io/badge/Maintenance_Track-bb_integrated-green?style=flat-square)
+![Version: 8.9.1-bb.1](https://img.shields.io/badge/Version-8.9.1--bb.1-informational?style=flat-square) ![AppVersion: v17.9.1](https://img.shields.io/badge/AppVersion-v17.9.1-informational?style=flat-square) ![Maintenance Track: bb_integrated](https://img.shields.io/badge/Maintenance_Track-bb_integrated-green?style=flat-square)
 
 GitLab is the most comprehensive AI-powered DevSecOps Platform.
 
@@ -27,7 +27,7 @@ The [upstream chart's release notes](https://gitlab.com/gitlab-org/charts/gitlab
 
 Install Helm
 
-<https://helm.sh/docs/intro/install/>
+https://helm.sh/docs/intro/install/
 
 ## Deployment
 
@@ -1146,3 +1146,4 @@ Please see the [contributing guide](./CONTRIBUTING.md) if you are interested in
 ---
 
 _This file is programatically generated using `helm-docs` and some BigBang-specific templates. The `gluon` repository has [instructions for regenerating package READMEs](https://repo1.dso.mil/big-bang/product/packages/gluon/-/blob/master/docs/bb-package-readme.md)._
+

chart/Chart.yaml

 ---
 apiVersion: v1
 name: gitlab
-version: 8.9.1-bb.0
+version: 8.9.1-bb.1
 appVersion: v17.9.1
 description: GitLab is the most comprehensive AI-powered DevSecOps Platform.
 keywords:

chart/templates/bigbang/networkpolicies/egress-istiod.yaml

@@ -12,7 +12,11 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          app.kubernetes.io/name: istio-controlplane
+          {{- if .Values.networkPolicies.istioNamespaceSelector }}
+          app.kubernetes.io/name: {{ .Values.networkPolicies.istioNamespaceSelector.egress }}
+          {{- else }}
+          app.kubernetes.io/name: "istio-controlplane"
+          {{- end }}
       podSelector:
         matchLabels:
           app: istiod

chart/templates/bigbang/networkpolicies/ingress-istio-pages.yaml

@@ -14,7 +14,11 @@ spec:
   - from:
     - namespaceSelector:
         matchLabels:
-          app.kubernetes.io/name: istio-controlplane
+          {{- if .Values.networkPolicies.istioNamespaceSelector }}
+          app.kubernetes.io/name: {{ .Values.networkPolicies.istioNamespaceSelector.ingress }}
+          {{- else }}
+          app.kubernetes.io/name: "istio-controlplane"
+          {{- end }}
       podSelector:
         matchLabels:
           {{- toYaml .Values.istio.pages.ingressLabels | nindent 10}}

chart/templates/bigbang/networkpolicies/ingress-istio-registry.yaml

@@ -14,7 +14,11 @@ spec:
   - from:
     - namespaceSelector:
         matchLabels:
-          app.kubernetes.io/name: istio-controlplane
+          {{- if .Values.networkPolicies.istioNamespaceSelector }}
+          app.kubernetes.io/name: {{ .Values.networkPolicies.istioNamespaceSelector.ingress }}
+          {{- else }}
+          app.kubernetes.io/name: "istio-controlplane"
+          {{- end }}
       podSelector:
         matchLabels:
           {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}}

chart/templates/bigbang/networkpolicies/ingress-istio-sidekiq.yaml

@@ -14,7 +14,11 @@ spec:
   - from:
     - namespaceSelector:
         matchLabels:
-          app.kubernetes.io/name: istio-controlplane
+          {{- if .Values.networkPolicies.istioNamespaceSelector }}
+          app.kubernetes.io/name: {{ .Values.networkPolicies.istioNamespaceSelector.ingress }}
+          {{- else }}
+          app.kubernetes.io/name: "istio-controlplane"
+          {{- end }}
       podSelector:
         matchLabels:
           {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}}

chart/templates/bigbang/networkpolicies/ingress-istio-webservice.yaml

@@ -14,7 +14,11 @@ spec:
   - from:
     - namespaceSelector:
         matchLabels:
-          app.kubernetes.io/name: istio-controlplane
+          {{- if .Values.networkPolicies.istioNamespaceSelector }}
+          app.kubernetes.io/name: {{ .Values.networkPolicies.istioNamespaceSelector.ingress }}
+          {{- else }}
+          app.kubernetes.io/name: "istio-controlplane"
+          {{- end }}
       podSelector:
         matchLabels:
           {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}}

docs/dev-overrides.yaml

@@ -37,12 +37,19 @@ kyvernoPolicies:
                 namespaces:
                   - gitlab-runner
 
+
 istioOperator:
   enabled: true
 
 istio:
   enabled: true
 
+istioCore:
+  enabled: false
+
+istioGateway:
+  enabled: false
+
 jaeger:
   enabled: false