[secrets-injector]: adds network-policy

system/secrets-injector/Chart.yaml

@@ -3,7 +3,7 @@ name: secrets-injector
 description: Secrets Injector
 
 type: application
-version: 1.1.19
+version: 1.1.20
 appVersion: "0.1.0"
 
 dependencies:

system/secrets-injector/templates/networkpolicy.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.networkPolicy.create }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: secrets-injector-allow
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: secrets-injector
+  policyTypes:
+    - Ingress
+  {{- with .Values.networkPolicy.ingress }}
+  ingress: {{ toYaml . | nindent 4 }}
+  {{- end }}
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: secrets-injector-deny
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      app: secrets-injector
+  policyTypes:
+    - Ingress
+  # no ingress rules => deny all
+{{- end }}

system/secrets-injector/values.yaml

@@ -30,4 +30,14 @@ alerts:
   enabled: true
   ruleSelector:
     prometheus: kubernetes
-
+networkPolicy:
+  create: false
+  ingress: []
+# Example allowing only from kube-system/vpn-shoot pod:
+#    - from:
+#        - namespaceSelector:
+#            matchLabels:
+#              kubernetes.io/metadata.name: kube-system
+#          podSelector:
+#            matchLabels:
+#              app: vpn-shoot