[Feature] NetworkPolicy in helm chart about kubelet-csr-approver

[clementnuss]

hi @jcpunk

I had a quick look, and I am not too sure what the network policy should look like.

it seems whitelisting the apiserver for egress traffic isn't as simple as expected: cilium/cilium#20550

(seems to require specifying the CIDR of the API server IP)

I've also checked another controller (OPA Gatekeeper) to see how they do it:
https://github.com/open-policy-agent/gatekeeper/blob/b7230e0bdc3479b867acd2fd0d7192b1182c59d4/charts/gatekeeper/templates/gatekeeper-controller-manager-network-policy.yaml#L4

they only have an optional NetPol that restricts what can enter the pod, nothing for egress.

How would you see it in our case ?

[jcpunk]

Alas, I don't know enough about what it needs networking wise...

perhaps something like:

  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
    - port: 443
      protocol: TCP

[clementnuss]

I think this type of network policy would more need to be enforced by the cluster operator.

also, typically the kube-apiserver pods run in hostNetwork mode, and are not covered by network policies, except when you use direct IP address.

That is not however something we can do for this project.

and regarding ingress netpol, here the only endpoint to cover is the /metrics, and again I think this could more be covered by the cluster operator, the security "risk" associated with that endpoint is not worth implementing a default netpol IMO.

therefore closing this issue :)