jklein
445ca36d7d
Gitea #143. Additive, default false, so the render is byte-identical to the previous release - proven by diffing both renders against origin/main rather than asserted. Switched on it adds 15008/TCP, ztunnel's HBONE tunnel, to the rule carrying the probe port, and - inside that rule's source-restricted branch - 169.254.7.127/32, the address the kubelet's probes arrive from once the pod is in the mesh. Ambient does not bypass NetworkPolicy enforcement, so without the port a pod whose namespace has joined the mesh is unreachable. The two halves are one value because the second is the one nobody thinks of: 15008 added by hand leaves a policy that passes review and drops every probe the first time probeSources is narrowed, and a pod that never becomes Ready reads as a broken application rather than as a policy. Minor, not major: additive value, unchanged default, unchanged render. Port half only: this chart offers no networkPolicy.probeSources - its probes put no packet on the network - so there is no redirected probe to allow and an ipBlock for one would match nothing while making the rule look like it did something. ci/run-networkpolicy-test.sh ties that exemption to the absence of probeSources, not to a chart name.
181 lines
8.2 KiB
YAML
181 lines
8.2 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
# users.conf is mounted into the samba container from the Secret the 1Password
|
|
# operator materializes from this item.
|
|
#
|
|
# Known limitation (#82): changing the item in the vault does NOT restart
|
|
# samba, so added, removed or re-passworded users stay invisible to the
|
|
# running smbd. Helm cannot hash the content (it never sees it - the operator
|
|
# fills the Secret in-cluster after rendering), so the checksum/config
|
|
# mechanism used for smb.conf does not apply here. The operator's own
|
|
# "operator.1password.io/auto-restart" annotation is no help either: it only
|
|
# ever restarts Deployments, and this workload is a StatefulSet (verified
|
|
# against onepassword-operator 1.12.0). After changing the users item,
|
|
# restart samba by hand:
|
|
# kubectl rollout restart statefulset <release>-samba-sfs
|
|
sambaUsersSecretRef: null
|
|
|
|
samba:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# NodePorts the SMB service is published on (service type NodePort).
|
|
smbNodePort: 30445
|
|
netbiosNodePort: 30139
|
|
shares:
|
|
- name: null
|
|
validUsers: null
|
|
description: null
|
|
size: null
|
|
# Extra environment variables for the samba container. Values are rendered
|
|
# through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
|
|
env: []
|
|
# SMB is not an HTTP protocol, so probe the main SMB TCP port.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: 50Mi
|
|
cpu: 0.1
|
|
ephemeralStorage: 50Mi
|
|
|
|
# Deviations from the repo's hardening baseline, forced by the
|
|
# ghcr.io/dockur/samba image (its entrypoint samba.sh):
|
|
# - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
|
|
# (groupadd/adduser/usermod) and smbd impersonates the authenticated
|
|
# share user per session, both of which require starting as root.
|
|
# - readOnlyRootFilesystem: false: the entrypoint writes to the root
|
|
# filesystem at startup (/etc/passwd + /etc/group for user creation,
|
|
# the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
|
|
# TDB databases under /var/lib/samba).
|
|
# - capabilities: ALL dropped except what a multi-user root file server
|
|
# needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
|
|
# user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
|
|
# on behalf of the users).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- NET_BIND_SERVICE
|
|
- SETGID
|
|
- SETUID
|
|
|
|
storageClass: longhorn
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# NetworkPolicy (Gitea #5). On by default. The reference implementation with
|
|
# the full reasoning is template-chart; the convention is in README, "Chart
|
|
# style guidelines", and the operator's view on this chart's wiki page.
|
|
# ---------------------------------------------------------------------------
|
|
networkPolicy:
|
|
# THERE IS ONLY ONE VALUE HERE BESIDES enabled, AND THAT IS DELIBERATE.
|
|
# Both of this chart's inbound rules are open to any source (see below), so
|
|
# neither allowedNamespaces nor probeSources would reach a rule - and a value
|
|
# that silently does nothing is worse than a value that is absent: it reads
|
|
# as a control. If a source restriction is ever wanted here it needs a rule
|
|
# to attach to first.
|
|
#
|
|
# WHAT THIS POLICY ALLOWS: inbound 445 and 139 - the POD ports - open to any
|
|
# source, and outbound nothing but DNS.
|
|
#
|
|
# BOTH INBOUND RULES ARE OPEN ON PURPOSE. The ports are published as
|
|
# NodePorts and the clients are machines on the LAN; after NodePort
|
|
# masquerading the source address is a cluster node, so a source selector
|
|
# could only be a list of node IPs - a restriction in appearance and a
|
|
# maintenance trap in fact. 445 is also the probe port.
|
|
#
|
|
# AND THE NUMBERS ARE 445 AND 139, NOT samba.smbNodePort AND
|
|
# samba.netbiosNodePort. A NetworkPolicy is evaluated at the pod's interface
|
|
# after kube-proxy has translated the NodePort, so the NodePort numbers would
|
|
# match nothing while looking strict - and would block every client.
|
|
#
|
|
# Not covered, and it does not matter here: the NetBIOS name-service
|
|
# broadcasts on 137/138 UDP are not published by this chart's Service at all,
|
|
# and clients reach the share by address rather than by browse list.
|
|
enabled: true
|
|
|
|
# The policy's INBOUND side. Mind the three names that overlap as substrings,
|
|
# because a search for "ingress" matches all of them and they are different
|
|
# things:
|
|
#
|
|
# ingress (top level) the Ingress OBJECT this chart
|
|
# renders - host, TLS, className
|
|
# networkPolicy.ingress this block: what the policy lets IN
|
|
# networkPolicy.ingressController the SOURCE SELECTOR for the ingress
|
|
# controller's pods. A SIBLING of this block
|
|
# and NO PART OF IT, despite the name.
|
|
ingress:
|
|
# Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
|
|
# additive: while it is false this chart renders byte for byte as it did
|
|
# before the value existed.
|
|
#
|
|
# It renders 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
|
|
# connection arrives on it, and ambient "does not and will never bypass
|
|
# Kubernetes NetworkPolicy enforcement", so without this port a pod whose
|
|
# namespace has joined the mesh is unreachable.
|
|
#
|
|
# ONE HALF SHORTER THAN ELSEWHERE, deliberately. In other charts this switch
|
|
# also adds 169.254.7.127/32 as a probe source, because inside the mesh the
|
|
# kubelet's probes are redirected away from the worker node's address. This
|
|
# chart has no networkPolicy.probeSources at all, so the rule carrying the
|
|
# probe port is never restricted by source - and an unrestricted rule needs
|
|
# no probe address. An ipBlock for one would match nothing while making the
|
|
# rule look like it did something, which is the kind of strict-looking empty
|
|
# rule ci/run-networkpolicy-test.sh exists to catch; that script ties the
|
|
# exemption to the absence of probeSources rather than to a chart name.
|
|
#
|
|
# NOT PROVEN: that 15008 alone is enough comes from Istio's documentation;
|
|
# measured on this cluster is only which listeners ztunnel opens, and no
|
|
# namespace carries istio.io/dataplane-mode yet.
|
|
ambientMesh: false
|
|
|
|
egress:
|
|
# Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
|
|
# has no switch - a knob whose only other setting breaks every name lookup
|
|
# in the pod is a trap, not a feature.
|
|
#
|
|
# PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
|
|
# laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
|
|
# so "only to the database host" cannot be written at all. Each entry
|
|
# permits its port to ANY destination. What the cap still buys is real: a
|
|
# compromised pod cannot open arbitrary outbound connections.
|
|
#
|
|
# A domain-joined Samba needs Kerberos (88) and LDAP (389 or 636) here. A
|
|
# standalone one needs nothing.
|
|
extraPorts: []
|