{{- /* NetworkPolicy for paperless-ngx (Gitea #5). Paperless reaches a Postgres and a Redis, and - when paperless.files.tikaGotenberg.enabled is true - the Tika and Gotenberg services, which in this repository are two other charts whose Services listen on port 80. That last rule is derived from the switch rather than always rendered, so a release without Tika does not carry a rule that permits nothing. TWO THINGS THIS POLICY DOES NOT COVER, and both are real rather than theoretical: 1. THE VALKEY SUBCHART'S POD. This chart declares valkey as an optional dependency, and the subchart renders its own StatefulSet with its own labels. It is not covered by THIS policy - but it does not need to be: the valkey chart ships a NetworkPolicy of its own, and it is the tighter one (Ingress-only, 6379 restricted by source, because its probes are exec probes and no kubelet traffic has to be let through). This is the one subchart in the repository that brings its own policy. 2. THE CONSUME CRONJOB'S PODS. paperless-consume.cronjob.yaml renders a pod template with NO LABELS AT ALL, so no podSelector can match it and no policy in this chart can restrict it. That is a gap in the convention, named here rather than glossed. What makes it tolerable: the CronJob's whole job is to move files between two mounted volumes, and the SMB share reaches it as a CSI volume - mounted by the NODE, not opened by the pod - so the pod itself opens no connection that a policy would have anything to say about. If that ever changes, the CronJob needs labels before it can need a policy. 3. MAIL FETCHING IS NOT PERMITTED. Paperless' mail accounts live in its DATABASE, configured through the web UI, so this chart cannot see them. A release that fetches mail needs IMAP (993 or 143) in networkPolicy.egress.extraPorts, and the symptom otherwise is a mail rule that silently stops importing. WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer. Only the ports declared below are reachable at all - whatever else the process binds, now or after the next app update, is blocked without anyone having to notice it exists. WHAT IT IS NOT: - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER hostnames, so "only to the database host" cannot be expressed at all. This cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN rule; Calico's GlobalNetworkSet could express one but would bind this chart to Calico, the same argument that kept implementation-specific objects out of the Gateway-API sweep (#114). Each egress rule therefore permits its PORT to any destination. - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is accepted by the API server and filters nothing, so everything reads as configured while nothing is filtered. - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part of the rendered object, travel into the cluster and appear in every release diff. ci/run-networkpolicy-test.sh fails on a rendered "#". THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is evaluated at the pod's network interface, after kube-proxy has already translated a NodePort to the targetPort, so a NodePort number here would match nothing while looking strict - and, being the only rule for that port, would block every inbound connection instead. ci/run-networkpolicy-test.sh asserts every port here against the containerPorts of the pod spec this policy selects. */ -}} {{- if .Values.networkPolicy.enabled }} {{- $np := .Values.networkPolicy }} {{- $ns := .Release.Namespace }} {{- $probeSources := $np.probeSources | default list }} {{- $allowedNs := $np.allowedNamespaces | default list }} {{- $ic := $np.ingressController | default dict }} {{- $routed := or .Values.ingress.enabled .Values.httpRoute.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy labels: app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy spec: {{- /* Selects the paperless server's StatefulSet pods. Note that this render may contain the valkey subchart's pods as well - this selector must not match them, and ci/run-networkpolicy-test.sh reports which pod templates it does match so that is visible rather than assumed. */}} podSelector: matchLabels: app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs policyTypes: - Ingress {{- /* Egress is listed because there is a lot to restrict and most of it is known. What is NOT permitted and is the plausible surprise: IMAP. Paperless' mail accounts are rows in its database, configured in the web UI, so the chart cannot see them - see networkPolicy.egress.extraPorts. */}} - Egress ingress: {{- /* 8000 - the only port this pod declares, the one the Service forwards 80 to, and the port all three probes address. The probe path. */}} - ports: - protocol: TCP port: 8000 {{- if $probeSources }} {{- /* RESTRICTED, because the operator supplied probeSources. The kubelet's probes come from the IP of the WORKER NODE running the pod, so that address has to be in the list or the pod never becomes Ready - and a pod that is never Ready reads as a broken application rather than as a policy. The ingress controller is added to the same rule, or the Ingress goes dark the moment this list is filled. */}} from: - namespaceSelector: matchLabels: {{- /* Set by Kubernetes itself on every namespace (>= 1.21), so this needs no labelling work on a namespace this chart does not own. */}} kubernetes.io/metadata.name: {{ $ns }} {{- if and $routed $ic.namespace }} {{- /* ONE from-entry with TWO selectors, which is an AND: pods carrying these labels IN that namespace. Written as two list entries it would be an OR, and would open the port to every pod in kube-system. */}} - namespaceSelector: matchLabels: kubernetes.io/metadata.name: {{ $ic.namespace | quote }} {{- with $ic.podLabels }} podSelector: matchLabels: {{- toYaml . | nindent 14 }} {{- end }} {{- end }} {{- range $allowedNs }} - namespaceSelector: matchLabels: kubernetes.io/metadata.name: {{ . | quote }} {{- end }} {{- range $probeSources }} - ipBlock: cidr: {{ . | quote }} {{- end }} {{- else }} {{- /* NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the cluster, because this port carries no NodePort. The alternative was to guess the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod stays un-Ready, the rollout times out, and the cause looks like the application. An empty "from: []" would be worse than either - it allows everything too, but while reading as a restriction. Narrow it with networkPolicy.probeSources. */}} {{- end }} egress: {{- /* DNS, unconditionally. There is no value to switch this off, and that is deliberate: a knob whose only other setting breaks every name lookup in the pod is a trap and not a feature. */}} - ports: - protocol: UDP port: 53 - protocol: TCP port: 53 {{- /* PostgreSQL on the STANDARD port. The connection details live in a 1Password item this chart never parses, so this is the conventional port and not the configured one; a Postgres elsewhere is blocked and belongs in networkPolicy.egress.extraPorts. */}} - ports: - protocol: TCP port: 5432 {{- /* Redis/Valkey on the STANDARD port, same reasoning. This covers the bundled valkey subchart as well as an external one - the subchart's Service uses 6379 too. */}} - ports: - protocol: TCP port: 6379 {{- if .Values.paperless.files.tikaGotenberg.enabled }} {{- /* TIKA AND GOTENBERG, on port 80 - which is what their Services listen on in this repository, even though their containers use 9998 and 3000. That distinction is the whole reason this rule says 80: an EGRESS rule names the port on the DESTINATION as the client dials it, and the client dials the Service. Rendered only while paperless.files.tikaGotenberg.enabled is true, so a release without them carries no rule that permits nothing. Endpoints on another port - the containers' own 9998 and 3000, if addressed directly rather than through their Services - need networkPolicy.egress.extraPorts. */}} - ports: - protocol: TCP port: 80 {{- end }} {{- /* Outbound HTTPS, for the trained classifier's model downloads and for any remote resource a consumed document pulls. To any destination, because those are hostnames. */}} - ports: - protocol: TCP port: 443 {{- with $np.egress }} {{- with .extraPorts }} {{- /* Ports only, to any destination - see the header. This is the operator's escape hatch from the egress cap, and the only alternative to switching the whole policy off. */}} - ports: {{- range . }} - protocol: TCP port: {{ int . }} {{- end }} {{- end }} {{- end }} {{- end }}