feat!: enable istio and netpols for everything

bundle/uds-bundle.yaml

@@ -7,9 +7,11 @@ metadata:
   # x-release-please-end
 
 packages:
+  # this sets up the namespaces that we will need in order to configure the default databases (and corresponding secrets) that are setup below
   - name: dev-namespaces
     path: ../
     ref: 0.1.0
+
   - name: postgres-operator
     path: ../
     # x-release-please-start-version
@@ -22,3 +24,39 @@ packages:
             - name: POSTGRESQL
               description: "Configure postgres using CRs via the uds-postgres-config chart"
               path: postgresql
+              default:
+                enabled: true  # Set to false to not create the PostgreSQL resource
+                teamId: "uds"
+                volume:
+                  size: "10Gi"
+                numberOfInstances: 2
+                users:
+                  gitlab.gitlab: []  # database owner
+                  sonarqube.sonarqube: []  # database owner
+                  mattermost.mattermost: []  # database owner
+                databases:
+                  gitlabdb: gitlab.gitlab
+                  mattermostdb: mattermost.mattermost
+                  sonarqubedb: sonarqube.sonarqube
+                version: "13"
+                ingress:
+                  - remoteNamespace: gitlab
+                    remoteSelector:
+                      app: gitlab
+                  - remoteNamespace: mattermost
+                    remoteSelector:
+                      app: mattermost
+                  - remoteNamespace: sonarqube
+                    remoteSelector:
+                      app: sonarqube
+            - name: ACID_PG_CLUSTER_NETWORKING
+              description: "Allow connectivity to the acid pg cluster for testing (see tests/ folder)"
+              path: custom
+              default:
+                - direction: Egress
+                  selector:
+                    app.kubernetes.io/name: postgres-operator
+                  remoteNamespace: acid
+                  remoteSelector:
+                    cluster-name: pg-cluster
+                  description: "Egress to a non-default pg cluster"

bundle/uds-config.yaml

@@ -1,19 +0,0 @@
-variables:
-  postgres-operator:
-    postgresql:
-      enabled: true  # Set to false to not create the PostgreSQL resource
-      teamId: "uds"
-      volume:
-        size: "10Gi"
-      numberOfInstances: 2
-      users:
-        gitlab.gitlab: []  # database owner
-        sonarqube.sonarqube: []  # database owner
-        mattermost.mattermost: []  # database owner
-      databases:
-        gitlabdb: gitlab.gitlab
-        mattermostdb: mattermost.mattermost
-        sonarqubedb: sonarqube.sonarqube
-      version: "13"
-      ingress:
-        remoteGenerated: Anywhere

chart/templates/uds-package-postgres.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: uds.dev/v1alpha1
+kind: Package
+metadata:
+  name: postgres
+  namespace: {{ .Release.Namespace }}
+spec:
+  network:
+    allow:
+      - direction: Ingress
+        remoteGenerated: IntraNamespace
+
+      - direction: Egress
+        remoteGenerated: IntraNamespace
+
+      {{- range .Values.postgresql.ingress }}
+      - direction: Ingress
+        selector:
+          cluster-name: pg-cluster
+        {{- . | toYaml | nindent 8 }}
+      {{- end }}
+
+      - direction: Ingress
+        selector:
+          app.kubernetes.io/name: postgres-operator
+        remoteNamespace: postgres-operator
+        remoteSelector:
+          app.kubernetes.io/name: postgres-operator
+
+      - direction: Egress
+        selector:
+          cluster-name: pg-cluster
+        remoteGenerated: KubeAPI
+{{- end }}

chart/templates/uds-package.yaml

@@ -1,24 +1,37 @@
-{{- if .Values.postgresql.enabled }}
 apiVersion: uds.dev/v1alpha1
 kind: Package
 metadata:
-  name: postgres
-  namespace: {{ .Release.Namespace }}
+  name: postgres-operator
+  namespace: postgres-operator
 spec:
   network:
     allow:
-      - direction: Ingress
-        remoteGenerated: IntraNamespace
+      {{- if .Values.postgresql.enabled }}
       - direction: Egress
-        remoteGenerated: IntraNamespace
-      {{- if .Values.postgresql.ingress }}
-      - direction: Ingress
         selector:
+          app.kubernetes.io/name: postgres-operator
+        remoteNamespace: {{ .Release.Namespace }}
+        remoteSelector:
           cluster-name: pg-cluster
-        {{- .Values.postgresql.ingress | toYaml | nindent 8 }}
       {{- end }}
+
       - direction: Egress
         selector:
-          cluster-name: pg-cluster  
+          app.kubernetes.io/name: postgres-operator
         remoteGenerated: KubeAPI
-{{- end }}
+
+      # Custom rules for other scenarios (such as connecting to a non-default pg cluster)
+      {{- range .Values.custom }}
+      - direction: {{ .direction }}
+        selector:
+          {{ .selector | toYaml | nindent 10 }}
+        {{- if not .remoteGenerated }}
+        remoteNamespace: {{ .remoteNamespace }}
+        remoteSelector:
+          {{ .remoteSelector | toYaml | nindent 10 }}
+        port: {{ .port }}
+        {{- else }}
+        remoteGenerated: {{ .remoteGenerated }}
+        {{- end }}
+        description: {{ .description }}
+      {{- end }}

chart/values.yaml

@@ -13,9 +13,18 @@ postgresql:
 #     yourdb: youruser
 #   version: "13"
 #   ingress:
-#     remoteGenerated: Anywhere
+#     - remoteGenerated: Anywhere
 # or
 #   ingress:
-#     remoteNamespace: tempo
-#     remoteSelector:
-#      app.kubernetes.io/name: tempo
+#     - remoteNamespace: tempo
+#       remoteSelector:
+#         app.kubernetes.io/name: tempo
+
+custom: []
+  # - direction: Egress
+  #   selector:
+  #     app.kubernetes.io/name: postgres-operator
+  #   remoteNamespace: acid
+  #   remoteSelector:
+  #     cluster-name: pg-cluster
+  #   description: "Egress to a non-default pg cluster"

src/namespace/gitlab-ns.yaml

@@ -2,3 +2,7 @@ kind: Namespace
 apiVersion: v1
 metadata:
   name: gitlab
+  # This label is only needed for testing!
+  # In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
+  labels:
+    istio-injection: enabled

src/namespace/mattermost-ns.yaml

@@ -2,3 +2,7 @@ kind: Namespace
 apiVersion: v1
 metadata:
   name: mattermost
+  # This label is only needed for testing!
+  # In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
+  labels:
+    istio-injection: enabled

src/namespace/sonarqube-ns.yaml

@@ -2,3 +2,7 @@ kind: Namespace
 apiVersion: v1
 metadata:
   name: sonarqube
+  # This label is only needed for testing!
+  # In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
+  labels:
+    istio-injection: enabled

tasks.yaml

@@ -38,6 +38,14 @@ tasks:
       - task: dependencies:create
       - task: create:test-bundle
 
+  - name: dev
+    description: Deploy Postgres Operator on existing cluster
+    actions:
+      - task: create-pg-package
+      - task: dependencies:create
+      - task: create-pg-test-bundle
+      - task: deploy:test-bundle
+
 # CI will execute the following (via uds-common/.github/actions/test) so they need to be here with these names
 
   - name: test-package

tests/postgres/db-seed-cross-namespace.yaml

@@ -16,6 +16,8 @@ kind: Job
 metadata:
   name: db-seed-job
   namespace: gitlab
+  labels:
+    app: gitlab
 spec:
   template:
     spec:

tests/postgres/db-seed.yaml

@@ -16,6 +16,8 @@ kind: Job
 metadata:
   name: db-seed-job
   namespace: acid
+  labels:
+    app: acid
 spec:
   template:
     spec:

tests/postgres/postgres-minimal.yaml

@@ -2,6 +2,10 @@ kind: Namespace
 apiVersion: v1
 metadata:
   name: acid
+  # This label is only needed for testing!
+  # In a real deployment this namespace would be controlled by a UDS Package / the UDS Operator
+  labels:
+    istio-injection: enabled
 ---
 apiVersion: acid.zalan.do/v1
 kind: postgresql