Skip to content

Commit 315b301

Browse files
wallrj-cyberarkwallrj-cyberark
committed
[VC-48226]: Document the default NetworkPolicy and show example egress rules
- Document default NetworkPolicy behavior and recommend restricting rules - Add example Helm values for enabling networkPolicy per component - Update public best-practice YAML to enable networkPolicy keys Signed-off-by: Richard Wall <richard.wall@cyberark.com>
1 parent 2e29f61 commit 315b301

3 files changed

Lines changed: 111 additions & 0 deletions

File tree

‎content/docs/installation/best-practice.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,44 @@ Or you may prefer to use the custom resources provided by your CNI software.
4747
> 📖 Learn about the [Kubernetes builtin NetworkPolicy API](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
4848
> and see [some example policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-policies).
4949
50+
The cert-manager Helm chart allows you to create a `NetworkPolicy` resource for
51+
each `Deployment`.
52+
53+
By default, it allows inbound traffic to all the listening ports of each component.
54+
And by default, it allows outbound traffic to:
55+
- TCP port 443: For connections to the Kubernetes API server and other
56+
in-cluster and external HTTPS API servers.
57+
- TCP port 6443: For connections to the Kubernetes API server on OpenShift.
58+
- TCP and UDP port 53: To resolve DNS names using the in-cluster DNS and
59+
external DNS servers when using DNS01.
60+
- TCP port 80: So that the controller can perform ACME HTTP01 self-checks before
61+
accepting the ACME server challenge.
62+
63+
These are over-permissive defaults to provide a good installation experience.
64+
65+
You should customize the `ingress` and `egress` rules to restrict the inbound
66+
and outbound traffic to allow only those connections which are necessary for
67+
your cert-manager configuration.
68+
69+
Example Helm values:
70+
71+
```yaml
72+
# helm-values.yaml
73+
networkPolicy:
74+
enabled: true
75+
76+
webhook:
77+
networkPolicy:
78+
enabled: true
79+
80+
cainjector:
81+
networkPolicy:
82+
enabled: true
83+
```
84+
85+
There are examples of extended egress rules in the example Helm chart values
86+
file at the end of this document.
87+
5088
### Network Requirements
5189
5290
Here is an overview of the network requirements:

‎content/docs/releases/release-notes/release-notes-1.20.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ Be sure to review all new features and changes below, and read the full release
1212

1313
## Major Themes
1414

15+
### Network Policy
16+
17+
The cert-manager Helm chart now allows you to create `NetworkPolicy` resources
18+
for all the cert-manager Deployments.
19+
This makes it easier to follow [best practices when deploying cert-manager in production](../../installation/best-practice.md#network-requirements-and-network-policy).
20+
21+
### TODO ADD REMAINING THEMES
22+
1523
TODO
1624

1725
## Community

‎public/docs/installation/best-practice/values.best-practice.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,63 @@ volumeMounts:
3838
name: serviceaccount-token
3939
readOnly: true
4040

41+
# Enable the default network policy for cert-manager controller
42+
networkPolicy:
43+
enabled: true
44+
egress:
45+
46+
# Required: Kubernetes API requests.
47+
# Use port 6443 on OpenShift clusters.
48+
- ports:
49+
- port: 443
50+
protocol: TCP
51+
52+
# Required: DNS look ups.
53+
- ports:
54+
- port: 53
55+
protocol: TCP
56+
- port: 53
57+
protocol: UDP
58+
59+
# Some example egress rules designed to allow cert-manager E2E tests to run
60+
# with Network policies enabled. In production you should edit or remove these
61+
# to match your requirements.
62+
63+
# Example: Allow access to the HTTP01 solver pod for ACME HTTP01 self-checks
64+
# Only needed if your cluster users use the ACME issuer with HTTP01
65+
- ports:
66+
- port: 80
67+
protocol: TCP
68+
69+
# Example: In-cluster DNS (Bind) server used by the ACME issuer with DNS01
70+
- ports:
71+
- port: 8053
72+
protocol: UDP
73+
- port: 8053
74+
protocol: TCP
75+
to:
76+
- namespaceSelector:
77+
matchLabels:
78+
kubernetes.io/metadata.name: bind
79+
80+
# Example: In-cluster ACME server used by the ACME issuer
81+
- ports:
82+
- port: 14000
83+
protocol: TCP
84+
to:
85+
- namespaceSelector:
86+
matchLabels:
87+
kubernetes.io/metadata.name: pebble
88+
89+
# Example: In-cluster Vault servers used by the Vault issuer
90+
- to:
91+
- namespaceSelector:
92+
matchLabels:
93+
kubernetes.io/metadata.name: e2e-vault
94+
- namespaceSelector:
95+
matchLabels:
96+
kubernetes.io/metadata.name: e2e-vault-mtls
97+
4198
webhook:
4299
replicaCount: 3
43100
podDisruptionBudget:
@@ -70,6 +127,10 @@ webhook:
70127
name: serviceaccount-token
71128
readOnly: true
72129

130+
# Enable the default network policy for cert-manager webhook
131+
networkPolicy:
132+
enabled: true
133+
73134
cainjector:
74135
extraArgs:
75136
- --namespace=cert-manager
@@ -105,6 +166,10 @@ cainjector:
105166
name: serviceaccount-token
106167
readOnly: true
107168

169+
# Enable the default network policy for cert-manager cainjector
170+
networkPolicy:
171+
enabled: true
172+
108173
startupapicheck:
109174
automountServiceAccountToken: false
110175
serviceAccount:

0 commit comments

Comments
 (0)