Move networkpolicies out of /contrib into /common (kubeflow#2385) (ku…

…beflow#2457) * Move networkpolicies out of /contrib into /common (kubeflow#2385) * extend OWNERS file * disable seldon NP * enable seldon NP * add rawc0der as Reviewer * Remove rawc0der reviewer * remove the duplicate resource
doncorsean · Jul 18, 2024 · 9f8c18c · 9f8c18c
1 parent 86c118b
commit 9f8c18c
Show file tree

Hide file tree

Showing 24 changed files with 28 additions and 30 deletions.
diff --git a/contrib/networkpolicies/OWNERS → common/networkpolicies/OWNERS b/contrib/networkpolicies/OWNERS → common/networkpolicies/OWNERS
@@ -3,3 +3,4 @@ approvers:
 reviewers:
   - juliusvonkohout
   - kimwnasptd
+  - TobiasGoerke
diff --git a/contrib/networkpolicies/README.md → common/networkpolicies/README.md b/contrib/networkpolicies/README.md → common/networkpolicies/README.md
diff --git a/contrib/networkpolicies/cache-server.yaml → ...on/networkpolicies/base/cache-server.yaml b/contrib/networkpolicies/cache-server.yaml → ...on/networkpolicies/base/cache-server.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: cache-server
   namespace: kubeflow
@@ -18,4 +18,3 @@ spec:
           port: 8443
   policyTypes:
     - Ingress
-
diff --git a/...rib/networkpolicies/centraldashboard.yaml → ...etworkpolicies/base/centraldashboard.yaml b/...rib/networkpolicies/centraldashboard.yaml → ...etworkpolicies/base/centraldashboard.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: centraldashboard
   namespace: kubeflow

diff --git a/...olicies/default-allow-same-namespace.yaml → ...es/base/default-allow-same-namespace.yaml b/...olicies/default-allow-same-namespace.yaml → ...es/base/default-allow-same-namespace.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: default-allow-same-namespace
   namespace: kubeflow

diff --git a/contrib/networkpolicies/jupyter-web-app.yaml → ...networkpolicies/base/jupyter-web-app.yaml b/contrib/networkpolicies/jupyter-web-app.yaml → ...networkpolicies/base/jupyter-web-app.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: jupyter-web-app
   namespace: kubeflow

diff --git a/...rib/networkpolicies/katib-controller.yaml → ...etworkpolicies/base/katib-controller.yaml b/...rib/networkpolicies/katib-controller.yaml → ...etworkpolicies/base/katib-controller.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: katib-controller
   namespace: kubeflow
@@ -16,8 +16,8 @@ spec:
     - ports: # webhook
         - protocol: TCP
           port: 8443
-#    - ports: # metrics
-#        - protocol: TCP
-#          port: 8080
+  #    - ports: # metrics
+  #        - protocol: TCP
+  #          port: 8080
   policyTypes:
     - Ingress
diff --git a/...rib/networkpolicies/katib-db-manager.yaml → ...etworkpolicies/base/katib-db-manager.yaml b/...rib/networkpolicies/katib-db-manager.yaml → ...etworkpolicies/base/katib-db-manager.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: katib-db-manager
   namespace: kubeflow

diff --git a/contrib/networkpolicies/katib-ui.yaml → common/networkpolicies/base/katib-ui.yaml b/contrib/networkpolicies/katib-ui.yaml → common/networkpolicies/base/katib-ui.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: katib-ui
   namespace: kubeflow

diff --git a/...etworkpolicies/kserve-models-web-app.yaml → ...kpolicies/base/kserve-models-web-app.yaml b/...etworkpolicies/kserve-models-web-app.yaml → ...kpolicies/base/kserve-models-web-app.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: kserve-models-web-app
   namespace: kubeflow

diff --git a/contrib/networkpolicies/kserve.yaml → common/networkpolicies/base/kserve.yaml b/contrib/networkpolicies/kserve.yaml → common/networkpolicies/base/kserve.yaml
@@ -1,6 +1,5 @@
-
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: kserve
   namespace: kubeflow

diff --git a/contrib/networkpolicies/kustomization.yaml → ...n/networkpolicies/base/kustomization.yaml b/contrib/networkpolicies/kustomization.yaml → ...n/networkpolicies/base/kustomization.yaml
@@ -14,7 +14,7 @@ resources:
   - metadata-envoy.yaml
   - metadata-grpc-server.yaml
   - minio.yaml
-  - ml-pipeline-ui.yaml 
+  - ml-pipeline-ui.yaml
   - ml-pipeline.yaml
   - poddefaults.yaml
   - pvcviewer-webhook.yaml

diff --git a/contrib/networkpolicies/metadata-envoy.yaml → .../networkpolicies/base/metadata-envoy.yaml b/contrib/networkpolicies/metadata-envoy.yaml → .../networkpolicies/base/metadata-envoy.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: metatada-envoy
   namespace: kubeflow
@@ -21,4 +21,3 @@ spec:
         - podSelector: {}
   policyTypes:
     - Ingress
-
diff --git a/...networkpolicies/metadata-grpc-server.yaml → ...rkpolicies/base/metadata-grpc-server.yaml b/...networkpolicies/metadata-grpc-server.yaml → ...rkpolicies/base/metadata-grpc-server.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: metadata-grpc-server
   namespace: kubeflow
@@ -21,4 +21,3 @@ spec:
         - podSelector: {} # allow all pods from the same namespace
   policyTypes:
     - Ingress
-
diff --git a/contrib/networkpolicies/minio.yaml → common/networkpolicies/base/minio.yaml b/contrib/networkpolicies/minio.yaml → common/networkpolicies/base/minio.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: minio
   namespace: kubeflow
@@ -9,7 +9,7 @@ spec:
       - key: app
         operator: In
         values:
-          - minio        # artifact storage
+          - minio # artifact storage
   ingress:
     - from:
         - namespaceSelector:

diff --git a/contrib/networkpolicies/ml-pipeline-ui.yaml → .../networkpolicies/base/ml-pipeline-ui.yaml b/contrib/networkpolicies/ml-pipeline-ui.yaml → .../networkpolicies/base/ml-pipeline-ui.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: ml-pipeline-ui
   namespace: kubeflow

diff --git a/contrib/networkpolicies/ml-pipeline.yaml → common/networkpolicies/base/ml-pipeline.yaml b/contrib/networkpolicies/ml-pipeline.yaml → common/networkpolicies/base/ml-pipeline.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: ml-pipeline
   namespace: kubeflow

diff --git a/contrib/networkpolicies/poddefaults.yaml → common/networkpolicies/base/poddefaults.yaml b/contrib/networkpolicies/poddefaults.yaml → common/networkpolicies/base/poddefaults.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: poddefaults
   namespace: kubeflow
@@ -9,7 +9,7 @@ spec:
       - key: app
         operator: In
         values:
-          - poddefaults  # mutating webhook 
+          - poddefaults # mutating webhook
   # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html
   # The kubernetes api server must reach the webhook
   ingress:

diff --git a/...ib/networkpolicies/pvcviewer-webhook.yaml → ...tworkpolicies/base/pvcviewer-webhook.yaml b/...ib/networkpolicies/pvcviewer-webhook.yaml → ...tworkpolicies/base/pvcviewer-webhook.yaml
diff --git a/contrib/networkpolicies/seldon.yaml → common/networkpolicies/base/seldon.yaml b/contrib/networkpolicies/seldon.yaml → common/networkpolicies/base/seldon.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: seldon
   namespace: kubeflow
@@ -18,4 +18,3 @@ spec:
           port: 4443
   policyTypes:
     - Ingress
-
diff --git a/...networkpolicies/tensorboards-web-app.yaml → ...rkpolicies/base/tensorboards-web-app.yaml b/...networkpolicies/tensorboards-web-app.yaml → ...rkpolicies/base/tensorboards-web-app.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: tensorboards-web-app
   namespace: kubeflow

diff --git a/contrib/networkpolicies/volumes-web-app.yaml → ...networkpolicies/base/volumes-web-app.yaml b/contrib/networkpolicies/volumes-web-app.yaml → ...networkpolicies/base/volumes-web-app.yaml
@@ -1,5 +1,5 @@
-kind: NetworkPolicy
 apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: volumes-web-app
   namespace: kubeflow

diff --git a/contrib/networkpolicies/.gitkeep b/contrib/networkpolicies/.gitkeep
diff --git a/example/kustomization.yaml b/example/kustomization.yaml
@@ -12,6 +12,7 @@ sortOptions:
     - MutatingWebhookConfiguration
     - ServiceAccount
     - PodSecurityPolicy
+    - NetworkPolicy
     - Role
     - ClusterRole
     - RoleBinding
@@ -49,6 +50,8 @@ resources:
 - ../common/istio-1-17/cluster-local-gateway/base
 # Kubeflow namespace
 - ../common/kubeflow-namespace/base
+# NetworkPolicies
+- ../common/networkpolicies/base
 # Kubeflow Roles
 - ../common/kubeflow-roles/base
 # Kubeflow Istio Resources