hashicorp / hashicorp/vault-helm

Adjustments to Network Policies

Open
#925 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
We're facing 2 issues related to Network Policies when using this Helm chart:
- Is there a specific reason the Injector Webhook network policy is only [enabled](https://github.com/hashicorp/vault-helm/blob/9a16496e869abd8b5c6d63ee5119427e9cf2d353/templates/injector-network-policy.yaml#L8) for Openshift? I'd like to enable it on Kubernetes
- When enabling the Network Policy for the server, the `namespaceSelector` effectively blocks requests coming from outside of the cluster, e.g. an ALB. To solve that issue, these [2 lines](https://github.com/hashicorp/vault-helm/blob/main/templates/server-network-policy.yaml#L20-L21) should only be added if one wants to enforce namespace selectors. See an [example](https://github.com/grafana/helm-charts/blob/42df13326835bd8506c3a476d2df3c3f895bed81/charts/grafana/templates/networkpolicy.yaml#L37-L50) from the Grafana chart.

Contributor guide

Open the contributing guide

Research direction

Start with templates/injector-network-policy.yaml and templates/server-network-policy.yaml at the linked lines, then compare the Grafana network policy example. Confirm how the Helm values control each policy and whether tests cover them. Done means the injector policy can be enabled on Kubernetes and server ingress from outside the cluster is not blocked unless namespace selectors are requested.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.