UNCLASSIFIED - NO CUI

Skip to content

Integrate bb-common

Follow the bb-common Migration Guide to integrate bb-common into package.

Grafana Network Policies

Old Name New Name Notes Covered in bb-common
allow-ingress-prometheus N/A

Only applies if namespace is not grafana, and not monitoring. This does not need to transfer over, because it is covered by the bb-common policies:

{{ .Release.Name }}-default-egress-allow-all-in-ns
{{ .Release.Name }}-default-ingress-allow-all-in-ns

yes
allow-in-namespace-{{ .Release.Name }}

{{ .Release.Name }}-default-egress-allow-all-in-ns
{{ .Release.Name }}-default-ingress-allow-all-in-ns

{{ .Release.Name }}-default-egress-allow-all-in-ns
{{ .Release.Name }}-default-ingress-allow-all-in-ns

yes
default-deny-all-{{ .Release.Name }}

{{ .Release.Name }}-default-ingress-deny-all
{{ .Release.Name }}-default-egress-deny-all

{{ .Release.Name }}-default-ingress-deny-all
{{ .Release.Name }}-default-egress-deny-al

yes
allow-egress-grafana {{ .Release.Name }}-allow-egress-from-grafana-to-anywhere-any-port

This should be fixed later, as a wide open policy negates the purpose of having any policies.

no
allow-monitoring-test-egress N/A

Removed, as the namespace is never going to be not equal to grafana or monitoring.

Only applies if namespace is not grafana, and not monitoring
allow-istiod-egress {{ .Release.Name }}-default-egress-allow-istiod {{ .Release.Name }}-default-egress-allow-istiod yes
allow-tempo-egress

{{ .Release.Name }}-allow-egress-from-any-pod-to-ns-tempo-pod-tempo-tcp-port-9411

Added rule to the grafana template values in umbrella chart. no
egress-thanos

{{ .Release.Name }}-allow-egress-from-any-pod-to-ns-thanos-any-pod-tcp-port-9090

Added a rule in the umbrella chart for thanos.

no
allow-from-backstage-app-{{ .Release.Name }}

{{ .Release.Name }}-allow-ingress-to-grafana-tcp-port-3000-from-ns-backstage-pod-backstage

Added rule to the grafana template values in umbrella chart. no
allow-from-istio-ingressgateway-{{ .Release.Name }} {{ .Release.Name }}-allow-ingress-to-grafana-port-3000-gateway Added rule to the grafana template values in umbrella chart. no
Edited by Jesse Borden