Skip to content

Commit 1d7710f

Browse files
NatSquaredNatSquared
committed
DESENG-860: Implement NetworkPolicies to secure connections across containers
1 parent 7c74e01 commit 1d7710f

17 files changed

Lines changed: 278 additions & 43 deletions

‎CHANGELOG.MD‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
## November 17, 2025
2+
3+
- **Feature** Increase Openshift security with NetworkPolicies [🎟️ DESENG-860](https://citz-gdx.atlassian.net/browse/DESENG-860)
4+
- Defined NetworkPolicies for all applications to control traffic flow. Traffic is only allowed between pods that need to communicate.
5+
16
## November 14, 2025
27

38
- **Feature** Added app and API version info to footer [🎟️ DESENG-820](https://citz-gdx.atlassian.net/browse/DESENG-820)

‎CONTRIBUTING.md‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,28 @@ Examples of when to Request Changes
6565

6666
## Style Guide
6767

68-
- Avoid using CSS directly. Instead, style through Material UI theming or with CSS-in-JS
68+
### CSS
69+
70+
- Avoid using CSS directly where possible. Instead, style through Material UI theming or with CSS-in-JS
71+
72+
### Helm & Openshift
73+
74+
- Use Helm charts for deploying applications to Openshift.
75+
- Deployments to Openshift should be handled by Github Actions. If you need to test, only manually deploy to the `-dev` namespace.
76+
- Resources for a specific project should be named the same thing as the Helm chart (`{{ .Release.Name }}`).
77+
...Unless there are multiple resources of a type, in which case they should be suffixed with a unique identifier (e.g. `{{ .Release.Name }}-api`).
78+
- Define all environment-specific variables in the `values_dev.yaml`, `values_test.yaml`, or `values_prod.yaml` files.
79+
- Use Vault instead of Secrets for managing sensitive data.
80+
- Use ConfigMaps for managing non-sensitive configuration data, especially that which might change frequently.
81+
- You may use hardcoded values in templates if configurability is not predicted to be a concern.
82+
- NetworkPolicies should be defined for all applications to control traffic flow.
83+
NetworkPolicies should be defined in the _same_ Helm chart as the application they are _protecting_. (It will not matter if your selectors refer to resources that have not yet been deployed.)
6984

7085
## Common Components/Utilities
7186

7287
### MET API
7388

74-
- `@transational`: Database method decorator. If there is an exception during execution, the entire DB session will be safely rolled back to a point in time just before the decorated function was called. If not, the session will be saved, unless autocommit is set to False. This helps replace most session management boilerplate.
89+
- `@transactional`: Database method decorator. If there is an exception during execution, the entire DB session will be safely rolled back to a point in time just before the decorated function was called. If not, the session will be saved, unless autocommit is set to False. This helps replace most session management boilerplate.
7590
- `authorization.check_auth`: Checks a user for one or more roles and for the correct engagement.
7691
- `schema_utils.validate`: The most commonly used method for validating request data in resources. This method takes the request JSON data and compares it to a JSON file that acts as a schema for incoming requests of that type.
7792

‎openshift/analytics-api/templates/networkpolicy.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
kind: NetworkPolicy
2+
apiVersion: networking.k8s.io/v1
3+
metadata:
4+
name: {{ .Release.Name }}
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app: analytics-api
8+
app-group: met-analytics
9+
role: api
10+
spec:
11+
podSelector:
12+
matchLabels:
13+
app: {{ .Values.app.name }}
14+
role: api
15+
app-group: met-analytics
16+
policyTypes:
17+
- Ingress
18+
ingress:
19+
- from:
20+
# Allow from OpenShift router/ingress controller
21+
- namespaceSelector:
22+
matchLabels:
23+
network.openshift.io/policy-group: ingress
24+
# Allow from met-analytics (Redash) server
25+
- podSelector:
26+
matchLabels:
27+
app: met-analytics
28+
role: server
29+
app-group: met-app

‎openshift/api/templates/deployment-cron.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,13 @@ spec:
1111
replicas: {{ .Values.app_cron.deployment.replicas }}
1212
selector:
1313
matchLabels:
14-
app: {{ .Values.app_cron.name }}
14+
app: {{ .Values.app.name }}
15+
role: cron
1516
template:
1617
metadata:
1718
labels:
18-
app: {{ .Values.app_cron.name }}
19+
app: {{ .Values.app.name }}
20+
role: cron
1921
app-group: met-app
2022
environment: {{ .Values.environment }}
2123
annotations:

‎openshift/api/templates/networkpolicy.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
kind: NetworkPolicy
2+
apiVersion: networking.k8s.io/v1
3+
metadata:
4+
name: {{ .Release.Name }}
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app: met-api
8+
role: api
9+
spec:
10+
podSelector:
11+
matchLabels:
12+
app: met-api
13+
role: api
14+
policyTypes:
15+
- Ingress
16+
ingress:
17+
- from:
18+
# Allow from OpenShift router/ingress controller
19+
- namespaceSelector:
20+
matchLabels:
21+
network.openshift.io/policy-group: ingress
22+
# Allow from met-cron (same app, different role)
23+
- podSelector:
24+
matchLabels:
25+
app: met-api
26+
role: cron
27+
app-group: met-app
28+
{{- range .Values.app.allowIngressPodselectors }}
29+
- podSelector:
30+
matchLabels:
31+
{{ toYaml . | indent 10 }}
32+
{{- end }}

‎openshift/api/values.yaml‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
app:
22
name: met-api
3-
licenseplate: 'e903c2'
3+
licenseplate: "e903c2"
4+
allowIngressPodselectors: []
45

56
app_cron:
67
name: met-cron
@@ -18,28 +19,28 @@ email:
1819
# How many days before an engagement closes to send the "closing soon" email
1920
closingSoonAdvanceNoticeDays: 2
2021
# URL for the email service
21-
notificationsEndpoint: 'http://notify-api:8080/api/v1/notifications/email'
22+
notificationsEndpoint: "http://notify-api:8080/api/v1/notifications/email"
2223
# Send only to @gov.bc.ca addresses
2324
sendInternalOnly: false
2425
templateID:
25-
accessRequest: '41afa792-4c75-425a-9ad9-c558561d6669'
26-
closedEngagementRejected: 'e942dea1-094e-4021-9aac-21a0ac1f240d'
27-
closeout: 'b7ea041b-fc30-4ad3-acb2-82119dd4f95d'
28-
closingSoon: '30344886-ea33-4ca2-83e1-e5ebe9c3457d'
29-
rejected: '8410c055-587b-4788-bd2f-b563562bcb2d'
30-
publish: '7bf2ffcd-d69e-4c3f-9aa0-e8e89b491e92'
31-
submissionResponse: '07f0f037-5ccb-44c5-89c6-9fe86078323e'
32-
subscribe: '9cd4942b-8ac9-49ae-a869-c800c57a7472'
33-
verification: 'c4cc1633-321a-4400-8a22-272acecd836a'
26+
accessRequest: "41afa792-4c75-425a-9ad9-c558561d6669"
27+
closedEngagementRejected: "e942dea1-094e-4021-9aac-21a0ac1f240d"
28+
closeout: "b7ea041b-fc30-4ad3-acb2-82119dd4f95d"
29+
closingSoon: "30344886-ea33-4ca2-83e1-e5ebe9c3457d"
30+
rejected: "8410c055-587b-4788-bd2f-b563562bcb2d"
31+
publish: "7bf2ffcd-d69e-4c3f-9aa0-e8e89b491e92"
32+
submissionResponse: "07f0f037-5ccb-44c5-89c6-9fe86078323e"
33+
subscribe: "9cd4942b-8ac9-49ae-a869-c800c57a7472"
34+
verification: "c4cc1633-321a-4400-8a22-272acecd836a"
3435

3536
tenant:
36-
shortName: 'GDX'
37+
shortName: "GDX"
3738

3839
image:
3940
tag: latest
4041
namespace: e903c2-tools
41-
repository: 'image-registry.openshift-image-registry.svc:5000/e903c2-tools'
42+
repository: "image-registry.openshift-image-registry.svc:5000/e903c2-tools"
4243

4344
vault:
44-
namespace: 'platform-services'
45-
authPath: 'auth/k8s-gold'
45+
namespace: "platform-services"
46+
authPath: "auth/k8s-gold"

‎openshift/db/templates/networkpolicy.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
kind: NetworkPolicy
2+
apiVersion: networking.k8s.io/v1
3+
metadata:
4+
name: {{ .Release.Name }}
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
podSelector:
8+
matchLabels:
9+
app: met-patroni
10+
app.kubernetes.io/component: database
11+
policyTypes:
12+
- Ingress
13+
ingress:
14+
- from:
15+
{{- range .Values.db.allowIngressPodselectors }}
16+
- podSelector:
17+
matchLabels:
18+
{{ toYaml . | indent 10 }}
19+
{{- end }}

‎openshift/db/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,27 @@ app:
55
name: met-db
66
licenseplate: "e903c2"
77

8+
db:
9+
allowIngressPodselectors:
10+
- app.kubernetes.io/instance: dagster
11+
component: user-deployments
12+
- app.kubernetes.io/instance: dagster
13+
component: dagster-daemon
14+
- app.kubernetes.io/instance: dagster
15+
component: dagster-webserver
16+
- app: analytics-api
17+
role: api
18+
- app-group: met-app
19+
role: worker
20+
- app: met-api
21+
role: api
22+
- app: met-api
23+
role: cron
24+
- app: met-db
25+
role: backup
26+
827
backup:
28+
role: backup
929
enabled: true
1030
image:
1131
repository: "ghcr.io"

‎openshift/met-analytics/templates/deployment-adhoc-worker.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,28 @@
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
5-
labels:
6-
app: "{{ .Chart.Name }}-adhoc-worker"
75
name: "{{ .Chart.Name }}-adhoc-worker"
6+
labels:
7+
app: "{{ .Chart.Name }}"
8+
app-group: met-app
9+
role: worker
10+
sub-role: adhoc-worker
811
spec:
912
replicas: 1
1013
selector:
1114
matchLabels:
12-
app: "{{ .Chart.Name }}-adhoc-worker"
15+
app: "{{ .Chart.Name }}"
16+
app-group: met-app
17+
role: worker
18+
sub-role: adhoc-worker
1319
strategy:
1420
template:
1521
metadata:
1622
labels:
17-
app: "{{ .Chart.Name }}-adhoc-worker"
23+
app: "{{ .Chart.Name }}"
24+
app-group: met-app
25+
role: worker
26+
sub-role: adhoc-worker
1827
annotations:
1928
vault.hashicorp.com/agent-inject: 'true'
2029
vault.hashicorp.com/agent-init-first: 'true'

‎openshift/met-analytics/templates/deployment-scheduled-worker.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,28 @@
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
5-
labels:
6-
app: "{{ .Chart.Name }}-scheduled-worker"
75
name: "{{ .Chart.Name }}-scheduled-worker"
6+
labels:
7+
app: "{{ .Chart.Name }}"
8+
app-group: met-app
9+
role: worker
10+
sub-role: scheduled-worker
811
spec:
912
replicas: 1
1013
selector:
1114
matchLabels:
12-
app: "{{ .Chart.Name }}-scheduled-worker"
15+
app: "{{ .Chart.Name }}"
16+
app-group: met-app
17+
role: worker
18+
sub-role: scheduled-worker
1319
strategy:
1420
template:
1521
metadata:
1622
labels:
17-
app: "{{ .Chart.Name }}-scheduled-worker"
23+
app: "{{ .Chart.Name }}"
24+
app-group: met-app
25+
role: worker
26+
sub-role: scheduled-worker
1827
annotations:
1928
vault.hashicorp.com/agent-inject: 'true'
2029
vault.hashicorp.com/agent-init-first: 'true'

0 commit comments

Comments
 (0)