tree 3cd7103a3a4c2fcd0ce66b00c91960e83ffcfa46
parent d349df379baedaa374528f14880b8aa497162a6b
author Thomas Draebing <thomas.draebing@sap.com> 1551274445 +0100
committer Thomas Dräbing <thomas.draebing@sap.com> 1607003782 +0000

Add NetworkPolicies to the gerrit-replica chart

By default, the network traffic to and from Kubernetes pods is not
restricted, which poses a potential security risk. The traffic can be
restricted using the NetworkPolicy resource of Kubernetes, which hadn't
been done so far for the gerrit-replica chart.

This change adds basic NetworkPolicies to the gerrit-replica chart:

- All traffic is blocked by default to and from pods installed by the
  chart.
- Egress to DNS services is allowed. The required ports can be
  configured in the chart.
- External ingress traffic is allowed to port 8080 of the gerrit-replica
  pods
- Custom ingress- and egress-rules can be configured for the
  gerrit-replica and git-backend pods to adjust for setups that are not
  fully supported by the basic NetworkPolicies.
- By default, the ingress traffic to the git-backend is unrestricted.
  This is implemented as a custom rule in the chart's values.yaml file
  and should be further restricted.
  Leaving it unrestricted provides better initial compatibility.
- If istio is used, traffic between the istio ingressgateway and the
  pods of the gerrit-replica chart is allowed.

Using the NetworkPolicies of the chart is optional and disabled by
default to reduce the initial complexity.

Change-Id: I4d12d8e259b8f8c53785d3f9ce321eb04b92c439