Skip to content

Commit 533d516

Browse files
samuelarogbonlojkroepke
samuelarogbonlo
and
jkroepke
authored
[kube-prometheus-stack] Add NetworkPolicy support for Alertmanager (#5318)
Co-authored-by: jkroepke Co-authored-by: Jan-Otto Kröpke <github@jkroepke.de>
1 parent aff7604 commit 533d516

File tree

4 files changed

+302
-1
lines changed

4 files changed

+302
-1
lines changed

‎charts/kube-prometheus-stack/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ name: kube-prometheus-stack
3131
sources:
3232
- https://github.com/prometheus-community/helm-charts
3333
- https://github.com/prometheus-operator/kube-prometheus
34-
version: 69.3.3
34+
version: 69.4.0
3535
appVersion: v0.80.0
3636
kubeVersion: ">=1.19.0-0"
3737
home: https://github.com/prometheus-operator/kube-prometheus

‎charts/kube-prometheus-stack/templates/alertmanager/networkpolicy.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{{- if and .Values.alertmanager.enabled .Values.alertmanager.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ template "kube-prometheus-stack.fullname" . }}-alertmanager
6+
namespace: {{ template "kube-prometheus-stack.namespace" . }}
7+
labels:
8+
app: {{ template "kube-prometheus-stack.name" . }}-alertmanager
9+
{{- include "kube-prometheus-stack.labels" . | nindent 4 }}
10+
spec:
11+
podSelector:
12+
matchLabels:
13+
app.kubernetes.io/name: alertmanager
14+
policyTypes:
15+
{{- toYaml .Values.alertmanager.networkPolicy.policyTypes | nindent 4 }}
16+
ingress:
17+
# Allow ingress from gateway
18+
- from:
19+
- namespaceSelector:
20+
matchLabels:
21+
kubernetes.io/metadata.name: {{ .Values.alertmanager.networkPolicy.gateway.namespace }}
22+
{{- if and .Values.alertmanager.networkPolicy.gateway.podLabels (not (empty .Values.alertmanager.networkPolicy.gateway.podLabels)) }}
23+
podSelector:
24+
matchLabels:
25+
{{- toYaml .Values.alertmanager.networkPolicy.gateway.podLabels | nindent 14 }}
26+
{{- end }}
27+
ports:
28+
- port: {{ .Values.alertmanager.service.port }}
29+
protocol: TCP
30+
- port: {{ .Values.alertmanager.service.clusterPort }}
31+
protocol: TCP
32+
{{- if .Values.alertmanager.networkPolicy.monitoringRules.prometheus }}
33+
# Allow ingress from Prometheus
34+
- from:
35+
- podSelector:
36+
matchLabels:
37+
app.kubernetes.io/name: prometheus
38+
ports:
39+
- port: {{ .Values.alertmanager.service.port }}
40+
protocol: TCP
41+
{{- end }}
42+
{{- if .Values.alertmanager.networkPolicy.monitoringRules.loki }}
43+
# Allow ingress from Loki
44+
- from:
45+
- podSelector:
46+
matchLabels:
47+
app.kubernetes.io/name: loki
48+
ports:
49+
- port: {{ .Values.alertmanager.service.port }}
50+
protocol: TCP
51+
{{- end }}
52+
{{- if .Values.alertmanager.networkPolicy.enableClusterRules }}
53+
# Allow ingress from other Alertmanager pods (for clustering)
54+
- from:
55+
- podSelector:
56+
matchLabels:
57+
app.kubernetes.io/name: alertmanager
58+
ports:
59+
- port: {{ .Values.alertmanager.service.clusterPort }}
60+
protocol: TCP
61+
{{- end }}
62+
{{- if .Values.alertmanager.networkPolicy.monitoringRules.configReloader }}
63+
# Allow ingress for config reloader metrics
64+
- from:
65+
- podSelector:
66+
matchLabels:
67+
app.kubernetes.io/name: alertmanager
68+
component: config-reloader
69+
ports:
70+
- port: 8080
71+
protocol: TCP
72+
{{- end }}
73+
{{- with .Values.alertmanager.networkPolicy.additionalIngress }}
74+
{{- toYaml . | nindent 4 }}
75+
{{- end }}
76+
{{- if .Values.alertmanager.networkPolicy.egress.enabled }}
77+
egress:
78+
{{- with .Values.alertmanager.networkPolicy.egress.rules }}
79+
{{- toYaml . | nindent 4 }}
80+
{{- end }}
81+
{{- end }}
82+
{{- end }}

‎charts/kube-prometheus-stack/unittests/alertmanager/networkpolicy_test.yaml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
suite: test networkpolicy
2+
templates:
3+
- alertmanager/networkpolicy.yaml
4+
tests:
5+
- it: should be empty if alertmanager is not enabled
6+
set:
7+
alertmanager.enabled: false
8+
alertmanager.networkPolicy.enabled: true
9+
asserts:
10+
- hasDocuments:
11+
count: 0
12+
13+
- it: should be empty if networkpolicy is not enabled
14+
set:
15+
alertmanager.enabled: true
16+
alertmanager.networkPolicy.enabled: false
17+
asserts:
18+
- hasDocuments:
19+
count: 0
20+
21+
- it: should have correct API version and kind
22+
set:
23+
alertmanager.enabled: true
24+
alertmanager.networkPolicy.enabled: true
25+
asserts:
26+
- hasDocuments:
27+
count: 1
28+
- isKind:
29+
of: NetworkPolicy
30+
- isAPIVersion:
31+
of: networking.k8s.io/v1
32+
33+
- it: should configure gateway namespace correctly
34+
set:
35+
alertmanager.enabled: true
36+
alertmanager.networkPolicy.enabled: true
37+
alertmanager.networkPolicy.gateway.namespace: custom-gateway
38+
asserts:
39+
- equal:
40+
path: spec.ingress[0].from[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
41+
value: custom-gateway
42+
43+
- it: should configure gateway pod labels correctly
44+
set:
45+
alertmanager.enabled: true
46+
alertmanager.networkPolicy.enabled: true
47+
alertmanager.networkPolicy.gateway.podLabels:
48+
app.kubernetes.io/name: custom-gateway
49+
asserts:
50+
- equal:
51+
path: spec.ingress[0].from[0].podSelector.matchLabels
52+
value:
53+
app.kubernetes.io/name: custom-gateway
54+
55+
- it: should include Prometheus rules when enabled
56+
set:
57+
alertmanager.enabled: true
58+
alertmanager.networkPolicy.enabled: true
59+
alertmanager.networkPolicy.monitoringRules.prometheus: true
60+
alertmanager.service.port: 9093
61+
asserts:
62+
- matchRegex:
63+
path: spec.ingress[1].from[0].podSelector.matchLabels["app.kubernetes.io/name"]
64+
pattern: prometheus
65+
66+
- it: should include Loki rules when enabled
67+
set:
68+
alertmanager.enabled: true
69+
alertmanager.networkPolicy.enabled: true
70+
alertmanager.networkPolicy.monitoringRules.loki: true
71+
alertmanager.service.port: 9093
72+
asserts:
73+
- matchRegex:
74+
path: spec.ingress[2].from[0].podSelector.matchLabels["app.kubernetes.io/name"]
75+
pattern: loki
76+
77+
- it: should include cluster rules when enabled
78+
set:
79+
alertmanager.enabled: true
80+
alertmanager.networkPolicy.enabled: true
81+
alertmanager.networkPolicy.enableClusterRules: true
82+
alertmanager.service.clusterPort: 9094
83+
asserts:
84+
- matchRegex:
85+
path: spec.ingress[3].from[0].podSelector.matchLabels["app.kubernetes.io/name"]
86+
pattern: alertmanager
87+
88+
- it: should add additional ingress rules when specified
89+
set:
90+
alertmanager.enabled: true
91+
alertmanager.networkPolicy.enabled: true
92+
alertmanager.networkPolicy.additionalIngress:
93+
- from:
94+
- namespaceSelector:
95+
matchLabels:
96+
name: custom-namespace
97+
asserts:
98+
- equal:
99+
path: spec.ingress[-1].from[0].namespaceSelector.matchLabels.name
100+
value: custom-namespace
101+
102+
- it: should include egress rules when enabled
103+
set:
104+
alertmanager.enabled: true
105+
alertmanager.networkPolicy.enabled: true
106+
alertmanager.networkPolicy.egress:
107+
enabled: true
108+
rules:
109+
- to:
110+
- podSelector:
111+
matchLabels:
112+
name: smtp-relay
113+
asserts:
114+
- equal:
115+
path: spec.egress[0].to[0].podSelector.matchLabels.name
116+
value: smtp-relay
117+
118+
- it: should use specified policy types
119+
set:
120+
alertmanager.enabled: true
121+
alertmanager.networkPolicy.enabled: true
122+
alertmanager.networkPolicy.policyTypes:
123+
- Ingress
124+
- Egress
125+
asserts:
126+
- equal:
127+
path: spec.policyTypes
128+
value:
129+
- Ingress
130+
- Egress
131+
132+
- it: should handle empty gateway pod labels
133+
set:
134+
alertmanager.enabled: true
135+
alertmanager.networkPolicy.enabled: true
136+
alertmanager.networkPolicy.gateway.namespace: custom-gateway
137+
alertmanager.networkPolicy.gateway.podLabels: null
138+
alertmanager.networkPolicy.policyTypes[0]: Ingress
139+
alertmanager.service.port: 9093
140+
asserts:
141+
- hasDocuments:
142+
count: 1
143+
- isKind:
144+
of: NetworkPolicy
145+
- equal:
146+
path: spec.ingress[0].from[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
147+
value: custom-gateway
148+
- equal:
149+
path: spec.ingress[0].ports[0].port
150+
value: 9093

‎charts/kube-prometheus-stack/values.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,75 @@ alertmanager:
408408
##
409409
forceDeployDashboards: false
410410

411+
## Network Policy configuration
412+
##
413+
networkPolicy:
414+
# -- Enable network policy for Alertmanager
415+
enabled: false
416+
417+
# -- Define policy types. If egress is enabled, both Ingress and Egress will be used
418+
# Valid values are ["Ingress"] or ["Ingress", "Egress"]
419+
##
420+
policyTypes:
421+
- Ingress
422+
423+
# -- Gateway (formerly ingress controller) configuration
424+
##
425+
gateway:
426+
# -- Gateway namespace
427+
##
428+
namespace: "ingress-nginx"
429+
# -- Gateway pod labels
430+
##
431+
podLabels:
432+
app.kubernetes.io/name: ingress-nginx
433+
434+
# -- Additional custom ingress rules
435+
##
436+
additionalIngress: []
437+
# - from:
438+
# - namespaceSelector:
439+
# matchLabels:
440+
# name: another-namespace
441+
# podSelector:
442+
# matchLabels:
443+
# app: another-app
444+
445+
# -- Configure egress rules
446+
##
447+
egress:
448+
# -- Enable egress rules. When enabled, policyTypes will include Egress
449+
##
450+
enabled: false
451+
# -- Custom egress rules
452+
##
453+
rules: []
454+
# - to:
455+
# - namespaceSelector: {}
456+
# podSelector:
457+
# matchLabels:
458+
# name: smtp-relay
459+
# ports:
460+
# - port: 25
461+
# protocol: TCP
462+
463+
# -- Enable rules for alertmanager cluster traffic
464+
##
465+
enableClusterRules: true
466+
467+
# -- Configure monitoring component rules
468+
##
469+
monitoringRules:
470+
# -- Enable ingress from Prometheus
471+
##
472+
prometheus: true
473+
# -- Enable ingress from Loki
474+
##
475+
loki: true
476+
# -- Enable ingress for config reloader metrics
477+
##
478+
configReloader: true
479+
411480
## Service account for Alertmanager to use.
412481
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
413482
##

0 commit comments

Comments
 (0)