From de4d24b2f3121b6d7c960e682c3065591d3f58be Mon Sep 17 00:00:00 2001 From: Pierre GINDRAUD Date: Sat, 30 May 2026 16:40:52 +0200 Subject: [PATCH 1/2] feat(): allow network policy Signed-off-by: Pierre GINDRAUD --- charts/node-red/Chart.yaml | 2 +- .../templates/ciliumnetworkpolicy.yaml | 22 +++++++++++++++++ charts/node-red/templates/networkpolicy.yaml | 24 +++++++++++++++++++ charts/node-red/values.yaml | 24 +++++++++++++++++++ 4 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 charts/node-red/templates/ciliumnetworkpolicy.yaml create mode 100644 charts/node-red/templates/networkpolicy.yaml diff --git a/charts/node-red/Chart.yaml b/charts/node-red/Chart.yaml index ba2f472c..6aec4072 100644 --- a/charts/node-red/Chart.yaml +++ b/charts/node-red/Chart.yaml @@ -9,7 +9,7 @@ icon: https://nodered.org/about/resources/media/node-red-icon-2.png type: application -version: 0.40.1 +version: 0.41.0 appVersion: 4.1.2 keywords: diff --git a/charts/node-red/templates/ciliumnetworkpolicy.yaml b/charts/node-red/templates/ciliumnetworkpolicy.yaml new file mode 100644 index 00000000..26b3118b --- /dev/null +++ b/charts/node-red/templates/ciliumnetworkpolicy.yaml @@ -0,0 +1,22 @@ +{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "cilium") }} +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: {{ include "node-red.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "node-red.labels" . | nindent 4 }} +spec: + endpointSelector: + matchLabels: + k8s:app.kubernetes.io/name: '{{ include "node-red.name" . }}' + k8s:app.kubernetes.io/instance: '{{ .Release.Name }}' + {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.egress }} + egress: + {{ toYaml .Values.networkPolicy.cilium.egress | nindent 4 }} + {{- end }} + {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.ingress }} + ingress: + {{ toYaml .Values.networkPolicy.cilium.ingress | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/node-red/templates/networkpolicy.yaml b/charts/node-red/templates/networkpolicy.yaml new file mode 100644 index 00000000..a1e7dd76 --- /dev/null +++ b/charts/node-red/templates/networkpolicy.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.networkPolicy.enabled (eq .Values.networkPolicy.flavor "kubernetes") }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "node-red.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "node-red.labels" . | nindent 4 }} +spec: + {{- if .Values.networkPolicy.egress }} + egress: + {{- toYaml .Values.networkPolicy.egress | nindent 4 }} + {{- end }} + {{- if .Values.networkPolicy.ingress }} + ingress: + {{- toYaml .Values.networkPolicy.ingress | nindent 4 }} + {{- end }} + policyTypes: + - Egress + - Ingress + podSelector: + matchLabels: + {{- include "node-red.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/node-red/values.yaml b/charts/node-red/values.yaml index 5d4967ae..751978e2 100644 --- a/charts/node-red/values.yaml +++ b/charts/node-red/values.yaml @@ -199,6 +199,30 @@ ingress: # -- Name of the Issuer # name: "test" +# -- Define network policy targeting managed pod +networkPolicy: + enabled: false + # -- If cilium flavor is defined, fill definition here + cilium: + egress: + - toPorts: + - ports: + - port: "1883" + protocol: TCP + - port: "8883" + protocol: TCP + ingress: {} + # -- Choose policy flavor in 'kubernetes', 'cilium' + flavor: kubernetes + # -- If kubernetes flavor is defined, fill definition here + ingress: {} + egress: + - ports: + - port: 1883 + protocol: TCP + - port: 8883 + protocol: TCP + # -- Startup probe for the Deployment startupProbe: httpGet: From 28704ab5125fa23a7967a95d8518964fc99a3d1f Mon Sep 17 00:00:00 2001 From: Pierre GINDRAUD Date: Mon, 1 Jun 2026 22:32:15 +0200 Subject: [PATCH 2/2] feat(): improve network policy Signed-off-by: Pierre GINDRAUD --- charts/node-red/Chart.yaml | 2 +- charts/node-red/README.md | 6 +++ .../templates/ciliumnetworkpolicy.yaml | 4 +- charts/node-red/templates/networkpolicy.yaml | 6 ++- charts/node-red/values.yaml | 52 ++++++++++++++----- 5 files changed, 54 insertions(+), 16 deletions(-) diff --git a/charts/node-red/Chart.yaml b/charts/node-red/Chart.yaml index 6aec4072..b7384c8b 100644 --- a/charts/node-red/Chart.yaml +++ b/charts/node-red/Chart.yaml @@ -9,7 +9,7 @@ icon: https://nodered.org/about/resources/media/node-red-icon-2.png type: application -version: 0.41.0 +version: 0.42.0 appVersion: 4.1.2 keywords: diff --git a/charts/node-red/README.md b/charts/node-red/README.md index 94ada8b8..6f40272d 100644 --- a/charts/node-red/README.md +++ b/charts/node-red/README.md @@ -98,6 +98,12 @@ The command removes all the Kubernetes components associated with the chart and | metrics.serviceMonitor.relabelings | list | `[]` | Prometheus [RelabelConfigs] to apply to samples before scraping | | metrics.serviceMonitor.selector | object | `{}` | Prometheus ServiceMonitor selector | | nameOverride | string | `""` | Provide a name in place of node-red | +| networkPolicy.cilium.egress | list | `[]` | Cilium network policy egress https://docs.cilium.io/en/stable/security/policy/ | +| networkPolicy.cilium.ingress | list | `[]` | Cilium network policy ingress https://docs.cilium.io/en/stable/security/policy/ | +| networkPolicy.egress | list | `[]` | Kubernetes egress spec https://kubernetes.io/docs/concepts/services-networking/network-policies/ | +| networkPolicy.enabled | bool | `false` | Enable network policy management | +| networkPolicy.flavor | string | `kubernetes` | Network policy mode in kubernetes, cilium | +| networkPolicy.ingress | list | `[]` | | Kubernetes ingress spec https://kubernetes.io/docs/concepts/services-networking/network-policies/ | | nodeSelector | object | `{}` | Node selector | | npmrc.content | string | `"# Custom npmrc config\n"` | Configuration to add custom npmrc config | | npmrc.enabled | bool | `false` | Enable custom npmrc config | diff --git a/charts/node-red/templates/ciliumnetworkpolicy.yaml b/charts/node-red/templates/ciliumnetworkpolicy.yaml index 26b3118b..91a0648d 100644 --- a/charts/node-red/templates/ciliumnetworkpolicy.yaml +++ b/charts/node-red/templates/ciliumnetworkpolicy.yaml @@ -13,10 +13,10 @@ spec: k8s:app.kubernetes.io/instance: '{{ .Release.Name }}' {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.egress }} egress: - {{ toYaml .Values.networkPolicy.cilium.egress | nindent 4 }} + {{- toYaml .Values.networkPolicy.cilium.egress | nindent 4 }} {{- end }} {{- if and .Values.networkPolicy.cilium .Values.networkPolicy.cilium.ingress }} ingress: - {{ toYaml .Values.networkPolicy.cilium.ingress | nindent 4 }} + {{- toYaml .Values.networkPolicy.cilium.ingress | nindent 4 }} {{- end }} {{- end }} diff --git a/charts/node-red/templates/networkpolicy.yaml b/charts/node-red/templates/networkpolicy.yaml index a1e7dd76..fae41d85 100644 --- a/charts/node-red/templates/networkpolicy.yaml +++ b/charts/node-red/templates/networkpolicy.yaml @@ -16,9 +16,13 @@ spec: {{- toYaml .Values.networkPolicy.ingress | nindent 4 }} {{- end }} policyTypes: + {{- if .Values.networkPolicy.egress }} - Egress + {{- end }} + {{- if .Values.networkPolicy.ingress }} - Ingress + {{- end }} podSelector: matchLabels: - {{- include "node-red.selectorLabels" . | nindent 4 }} + {{- include "node-red.selectorLabels" . | nindent 6 }} {{- end }} diff --git a/charts/node-red/values.yaml b/charts/node-red/values.yaml index 751978e2..1519c6f0 100644 --- a/charts/node-red/values.yaml +++ b/charts/node-red/values.yaml @@ -204,24 +204,52 @@ networkPolicy: enabled: false # -- If cilium flavor is defined, fill definition here cilium: - egress: + egress: [] + # Exemple to talk to mqtt + # - toPorts: + # - ports: + # - port: "1883" + # protocol: TCP + # - port: "8883" + # protocol: TCP + # + # Exemple to restrict https output + # - toFQDNs: &dns_names + # - matchName: registry.npmjs.org + # toPorts: + # - ports: + # - port: "443" + # protocol: TCP + # - toEndpoints: + # - matchLabels: + # k8s:io.kubernetes.pod.namespace: kube-system + # k8s:k8s-app: kube-dns + # toPorts: + # - ports: + # - port: "53" + # protocol: UDP + # - port: "53" + # protocol: TCP + # rules: + # dns: *dns_names + ingress: - toPorts: - ports: - - port: "1883" - protocol: TCP - - port: "8883" - protocol: TCP - ingress: {} + - port: http # -- Choose policy flavor in 'kubernetes', 'cilium' flavor: kubernetes # -- If kubernetes flavor is defined, fill definition here - ingress: {} - egress: + ingress: - ports: - - port: 1883 - protocol: TCP - - port: 8883 - protocol: TCP + - protocol: TCP + port: http + egress: [] + # Exemple to talk to mqtt + # - ports: + # - port: 1883 + # protocol: TCP + # - port: 8883 + # protocol: TCP # -- Startup probe for the Deployment startupProbe: