hashicorp / hashicorp/vault-helm
Adjustments to Network Policies
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
We're facing 2 issues related to Network Policies when using this Helm chart:
- Is there a specific reason the Injector Webhook network policy is only [enabled](https://github.com/hashicorp/vault-helm/blob/9a16496e869abd8b5c6d63ee5119427e9cf2d353/templates/injector-network-policy.yaml#L8) for Openshift? I'd like to enable it on Kubernetes
- When enabling the Network Policy for the server, the `namespaceSelector` effectively blocks requests coming from outside of the cluster, e.g. an ALB. To solve that issue, these [2 lines](https://github.com/hashicorp/vault-helm/blob/main/templates/server-network-policy.yaml#L20-L21) should only be added if one wants to enforce namespace selectors. See an [example](https://github.com/grafana/helm-charts/blob/42df13326835bd8506c3a476d2df3c3f895bed81/charts/grafana/templates/networkpolicy.yaml#L37-L50) from the Grafana chart.
Contributor guide
Research direction
Start with templates/injector-network-policy.yaml and templates/server-network-policy.yaml at the linked lines, then compare the Grafana network policy example. Confirm how the Helm values control each policy and whether tests cover them. Done means the injector policy can be enabled on Kubernetes and server ingress from outside the cluster is not blocked unless namespace selectors are requested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100