networkpolicy: allow enabling network egress

Create .Values.networkPolicies.allowExternalRegistryEgress

Summary

Reconfigure existing (hidden) NetworkPolicy to be able to optionally enable an egress rule that allows the Kyverno Admission Controller to communicate with external networks. This is required when the container registry exists outside of the network the cluster is running in (e.g. dogfood -> registry1) and the Kyverno policy require-image-signature is enabled, as the admission controller will need to communicate with the registry to validate the container signature.

NetworkPolicy defaults:

$ helm template build chart --set networkPolicies.enabled=true | grep "allow-egress-container-registry"
# builds with no issues

Enabling egress (with no port override)

$ helm template build chart --set networkPolicies.enabled=true --set networkPolicies.externalRegistries.allowEgress=true | grep -A 30 "allow-egress-container-registry"
  name: allow-egress-container-registry
  namespace: default
  labels:
    app.kubernetes.io/component: admission-controller
    app.kubernetes.io/instance: build
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: build-kyverno
    app.kubernetes.io/version: 3.0.0-bb.10
    helm.sh/chart: kyverno-3.0.0-bb.10
    app: kyverno
spec:
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 169.254.169.254/32
      ports:
        - protocol: TCP
          port: 443
  podSelector: 
    matchLabels:
        app.kubernetes.io/component: admission-controller
        app.kubernetes.io/instance: build
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: build-kyverno
        app.kubernetes.io/version: 3.0.0-bb.10
        helm.sh/chart: kyverno-3.0.0-bb.10
  policyTypes:
    - Egress

Additional ports:

networkPolicies:
  enabled: true
  externalRegistries:
    allowEgress: true
    ports: 
    - port: 1234
      protocol: TCP

$ helm template build chart -f override.yaml | grep -A 30 "allow-egress-container-registry"
  name: allow-egress-container-registry
  namespace: default
  labels:
    app.kubernetes.io/component: admission-controller
    app.kubernetes.io/instance: build
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: build-kyverno
    app.kubernetes.io/version: 3.0.0-bb.10
    helm.sh/chart: kyverno-3.0.0-bb.10
    app: kyverno
spec:
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 169.254.169.254/32
      ports:
      - port: 1234
        protocol: TCP
  podSelector: 
    matchLabels:
        app.kubernetes.io/component: admission-controller
        app.kubernetes.io/instance: build
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: build-kyverno
        app.kubernetes.io/version: 3.0.0-bb.10
        helm.sh/chart: kyverno-3.0.0-bb.10
  policyTypes:
    - Egress

chart/templates/bigbang/network-policy/egress-image-repository.yaml

-{{- if and .Values.networkPolicies.enabled .Values.registries }}
+{{- if and .Values.networkPolicies.enabled (.Values.networkPolicies.externalRegistries).allowEgress }}
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: allow-egress-container-registry
   namespace: {{ .Release.Namespace }}
-  labels: {{- include "kyverno.labels.merge" (list (include "kyverno.labels.common" .) (include "kyverno.matchLabels.common" .)) | nindent 4 }}
+  labels: {{- include "kyverno.labels.merge" (list (include "kyverno.labels.common" .) (include "kyverno.admission-controller.matchLabels" .)) | nindent 4 }}
     app: kyverno
 spec:
   egress:
@@ -13,9 +13,15 @@ spec:
           cidr: 0.0.0.0/0
           except:
           - 169.254.169.254/32
-      ports: {{ toYaml .Values.registries.ports | nindent 6 }}
+      ports:
+        {{- if .Values.networkPolicies.externalRegistries.ports }}
+        {{- toYaml .Values.networkPolicies.externalRegistries.ports | nindent 6 }}
+        {{- else }}
+        - protocol: TCP
+          port: 443
+        {{- end }}
   podSelector: 
-    matchLabels: {{- include "kyverno.labels.merge" (list (include "kyverno.labels.common" .) (include "kyverno.matchLabels.common" .)) | nindent 8 }}
+    matchLabels: {{- include "kyverno.labels.merge" (list (include "kyverno.labels.common" .) (include "kyverno.admission-controller.matchLabels" .)) | nindent 8 }}
   policyTypes:
     - Egress
-{{- end }}
\ No newline at end of file
+{{- end }}