networkpolicy: allow enabling network egress

Create .Values.networkPolicies.allowExternalRegistryEgress

Summary

Reconfigure existing (hidden) NetworkPolicy to be able to optionally enable an egress rule that allows the Kyverno Admission Controller to communicate with external networks. This is required when the container registry exists outside of the network the cluster is running in (e.g. dogfood -> registry1) and the Kyverno policy require-image-signature is enabled, as the admission controller will need to communicate with the registry to validate the container signature.

NetworkPolicy defaults:

$ helm template build chart --set networkPolicies.enabled=true | grep "allow-egress-container-registry"
# builds with no issues

Enabling egress (with no port override)

$ helm template build chart --set networkPolicies.enabled=true --set networkPolicies.externalRegistries.allowEgress=true | grep -A 30 "allow-egress-container-registry"
  name: allow-egress-container-registry
  namespace: default
  labels:
    app.kubernetes.io/component: admission-controller
    app.kubernetes.io/instance: build
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: build-kyverno
    app.kubernetes.io/version: 3.0.0-bb.10
    helm.sh/chart: kyverno-3.0.0-bb.10
    app: kyverno
spec:
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 169.254.169.254/32
      ports:
        - protocol: TCP
          port: 443
  podSelector: 
    matchLabels:
        app.kubernetes.io/component: admission-controller
        app.kubernetes.io/instance: build
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: build-kyverno
        app.kubernetes.io/version: 3.0.0-bb.10
        helm.sh/chart: kyverno-3.0.0-bb.10
  policyTypes:
    - Egress

Additional ports:

networkPolicies:
  enabled: true
  externalRegistries:
    allowEgress: true
    ports: 
    - port: 1234
      protocol: TCP

$ helm template build chart -f override.yaml | grep -A 30 "allow-egress-container-registry"
  name: allow-egress-container-registry
  namespace: default
  labels:
    app.kubernetes.io/component: admission-controller
    app.kubernetes.io/instance: build
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: build-kyverno
    app.kubernetes.io/version: 3.0.0-bb.10
    helm.sh/chart: kyverno-3.0.0-bb.10
    app: kyverno
spec:
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 169.254.169.254/32
      ports:
      - port: 1234
        protocol: TCP
  podSelector: 
    matchLabels:
        app.kubernetes.io/component: admission-controller
        app.kubernetes.io/instance: build
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: build-kyverno
        app.kubernetes.io/version: 3.0.0-bb.10
        helm.sh/chart: kyverno-3.0.0-bb.10
  policyTypes:
    - Egress

added statusreview label

assigned to @daniel.dides

added 1 commit

• 6979b09a - Empty newline at end of file

Compare with previous version

added 1 commit

• 0e4d0f4c - whoops editor hid the new line

Compare with previous version

added 1 commit

• d4179f97 - Allow entering in additional ports

Compare with previous version

changed the description

added 1 commit

• 02617888 - Correct variable reference, better default

Compare with previous version

added 1 commit

• 0b4fc391 - Update readme

Compare with previous version

requested review from @mlunato47, @obuh.alozie, @chris.oconnell, @enochofori777, and @ryan.j.garcia

added 8 commits

• 0b4fc391...b39e7e9d - 2 commits from branch main
• ce083034 - networkpolicy: allow enabling network egress
• 7bfa8e42 - Empty newline at end of file
• 47818828 - whoops editor hid the new line
• d3eebb30 - Allow entering in additional ports
• ec1b8220 - Correct variable reference, better default
• e6f9be78 - Update readme

Compare with previous version

added 1 commit

• 48ea860e - fix to use bb.10 version since prior update did not generate tag

Compare with previous version

assigned to @chris.oconnell

approved this merge request

mentioned in commit ed4ba74c

merged

changed milestone to %2.14.0

mentioned in merge request big-bang/bigbang!3382 (merged)