jklein
31d37c9767
Major, as every chart in this rollout is: networkPolicy.enabled defaults to true, so the object reaches running releases on the next upgrade. The simplest policy of the sweep, and the one to read first. CyberChef is a static web app - nginx serves files, the recipes run in the visitor's browser, the pod holds no state and calls nothing - so what the policy buys is the two CEILINGS rather than any source restriction: inbound is capped at 8080, the single port the pod declares, and outbound at DNS, which is as tight as the object goes without breaking name resolution. The 8080 rule carries no source selector by default, and that is deliberate rather than an oversight: 8080 is the port all three probes address, and the kubelet probes from the IP of the worker node running the pod, which no chart can know. Guessing it wrong leaves the pod permanently un-Ready, a symptom that reads as a broken application. Narrowing it is networkPolicy.probeSources, and the restricted branch then also carries the ingress controller - measured as the rke2-traefik DaemonSet in kube-system, which serves this chart's HTTPRoute as well, since the same Traefik backs the Gateway API here. Part of #5
157 lines
8.2 KiB
Plaintext
157 lines
8.2 KiB
Plaintext
{{- $replicas := include "cyberchef.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.cyberchef.replicas) -}}
|
|
{{- $httpRoute := .Values.httpRoute | default dict -}}
|
|
{{- $hostnames := $httpRoute.hostnames | default list -}}
|
|
{{- if not $hostnames -}}
|
|
{{- $hostnames = list .Values.ingress.domain -}}
|
|
{{- end -}}
|
|
CyberChef {{ .Chart.AppVersion }} — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}.
|
|
|
|
{{- if .Values.ingress.enabled }}
|
|
|
|
ACCESS — INGRESS MODE (ingress.enabled: true, httpRoute.enabled: false)
|
|
https://{{ .Values.ingress.domain }}
|
|
|
|
The certificate is requested by cert-manager through the "{{ .Values.ingress.clusterIssuer }}"
|
|
cluster issuer. Until it has been issued the browser shows a warning; follow it with
|
|
|
|
kubectl -n {{ .Release.Namespace }} get certificate tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
|
|
This chart has no secrets and no volumes — the two ingress values above are
|
|
everything an installation needs.
|
|
{{- else if $httpRoute.enabled }}
|
|
|
|
ACCESS — GATEWAY MODE (httpRoute.enabled: true, ingress.enabled: false)
|
|
{{- range $hostnames }}
|
|
https://{{ . }}
|
|
{{- end }}
|
|
|
|
This release renders an HTTPRoute ({{ .Release.Name }}-{{ .Chart.Name }}-httproute) and NOTHING else
|
|
of the routing path — no Gateway, no class, no Certificate. Three things
|
|
therefore belong to the cluster and not to this chart, and if any of them is
|
|
missing the hostname above simply does not answer:
|
|
|
|
1. The Gateway-API CRDs. Without them this install would have failed, so
|
|
they are present — nothing to check.
|
|
2. The Gateway named in httpRoute.parentRefs
|
|
{{- range $httpRoute.parentRefs }}
|
|
{{ .name }}{{ if .namespace }} in namespace {{ .namespace }}{{ end }}{{ if .sectionName }}, listener {{ .sectionName }}{{ end }}
|
|
{{- end }}
|
|
must exist AND its listener must allow routes from this namespace
|
|
({{ .Release.Namespace }}) in allowedRoutes. A rejected attachment is
|
|
visible only in the route's status:
|
|
|
|
kubectl -n {{ .Release.Namespace }} get httproute {{ .Release.Name }}-{{ .Chart.Name }}-httproute -o yaml
|
|
|
|
Read status.parents[].conditions — "Accepted: True" and
|
|
"ResolvedRefs: True" is what a working attachment looks like. An empty
|
|
status means no controller has looked at the route at all.
|
|
3. The TLS certificate for the hostname, on the Gateway's listener.
|
|
ingress.clusterIssuer is NOT used in this mode and is not required —
|
|
the chart renders no Certificate here, so there is no
|
|
tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress secret and nothing for cert-manager to do
|
|
on behalf of this release.
|
|
|
|
ingress.annotations is also inert in this mode: the Gateway API has no
|
|
annotation channel for controller behaviour. See the note below on who can
|
|
use this instance.
|
|
{{- else }}
|
|
|
|
ACCESS — NEITHER INGRESS NOR HTTPROUTE
|
|
ingress.enabled and httpRoute.enabled are both false, so this release has no
|
|
Ingress, no HTTPRoute and no certificate; ingress.domain and
|
|
ingress.clusterIssuer are not needed. The app is only reachable inside the
|
|
cluster, as {{ .Release.Name }}-{{ .Chart.Name }}-service:80. To open it locally:
|
|
|
|
kubectl -n {{ .Release.Namespace }} port-forward svc/{{ .Release.Name }}-{{ .Chart.Name }}-service 8080:80
|
|
|
|
Then browse to http://localhost:8080. To publish it instead, set either
|
|
ingress.enabled=true with ingress.domain and ingress.clusterIssuer, or
|
|
httpRoute.enabled=true with ingress.domain and httpRoute.parentRefs.
|
|
{{- end }}
|
|
{{ if eq $replicas "0" }}
|
|
SCALED TO ZERO
|
|
{{ if .Values.scaleDown }}scaleDown: true{{ else }}cyberchef.replicas: 0{{ end }} — the deployment runs with replicas: 0, so the endpoint
|
|
above does not answer until you set it back and upgrade again. Service{{ if .Values.ingress.enabled }} and
|
|
Ingress stay in place, so the certificate is not re-issued.{{ else if $httpRoute.enabled }} and
|
|
HTTPRoute stay in place, so the route keeps pointing at a Service with no
|
|
endpoints — the Gateway answers with an error of its own rather than with
|
|
nothing.{{ else }} stays in
|
|
place.{{ end }}
|
|
{{ end }}
|
|
ANYONE WHO REACHES THE URL CAN USE IT
|
|
{{- if $httpRoute.enabled }}
|
|
CyberChef has no login, and this chart adds none. In GATEWAY MODE there is no
|
|
place in this chart to put one either: the Gateway API has no annotation
|
|
channel, so the ingress-nginx external-auth or basic-auth annotations that
|
|
cover this in Ingress mode have NO counterpart here, and the chart renders no
|
|
implementation-specific policy object on purpose (it would bind the chart to
|
|
one Gateway implementation). Protection has to come from the Gateway itself —
|
|
a listener that is not publicly reachable, or that implementation's own auth
|
|
filter/policy, configured next to the Gateway and not here.
|
|
{{- else }}
|
|
CyberChef has no login, and this chart adds none. If it must not be open to
|
|
everyone, put authentication in front of it via ingress.annotations — the
|
|
chart merges them into the Ingress, e.g. ingress-nginx external auth or
|
|
basic auth annotations. Note that this escape hatch exists in Ingress mode
|
|
only: httpRoute.enabled has no annotation channel at all.
|
|
{{- end }}
|
|
|
|
NOTHING TO BACK UP, NOTHING TO MIGRATE
|
|
CyberChef is a static web app: recipes and inputs are processed in the
|
|
visitor's browser and never reach the server. The pod only serves files and
|
|
holds no state, so app-version upgrades and rollbacks carry no data risk and
|
|
need no migration step.
|
|
{{- if .Values.cyberchef.env }}
|
|
|
|
cyberchef.env HAS NO EFFECT ON THE APP
|
|
cyberchef.env is set. The entries reach the nginx process that serves the
|
|
files, but the served CyberChef bundle is static and reads none of them —
|
|
configuration has to happen in the browser.
|
|
{{- end }}
|
|
{{- if .Values.networkPolicy.enabled }}
|
|
|
|
NETWORKPOLICY IS ACTIVE — WHAT IT CAPS, AND WHAT IT DOES NOT
|
|
{{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy selects this workload's pods.
|
|
Inbound: TCP 8080 only, the single port this pod declares. Outbound: DNS{{ with .Values.networkPolicy.egress }}{{ with .extraPorts }}
|
|
plus TCP {{ join ", " . }}{{ end }}{{ end }} — a static file server needs nothing more.
|
|
|
|
Three limits belong in the same breath, because none of them is visible in
|
|
the object itself:
|
|
|
|
- EGRESS IS BY PORT, NEVER BY DESTINATION. A NetworkPolicy matches CIDRs and
|
|
selectors and cannot express a hostname, so every egress rule permits its
|
|
port to ANY address. That is a limit of the object, not a shortcut — this
|
|
cluster's CNI (Canal: Flannel plus Calico) has no FQDN rule either. An
|
|
outbound port the chart does not know about is BLOCKED: add it to
|
|
networkPolicy.egress.extraPorts, and expect to find out through an
|
|
application-level connection error rather than through this object.
|
|
{{- if .Values.networkPolicy.probeSources }}
|
|
- THE PROBE PATH IS RESTRICTED in this release, because
|
|
networkPolicy.probeSources is set to
|
|
{{ join ", " .Values.networkPolicy.probeSources }}
|
|
Probes come from the IP of the WORKER NODE running the pod. If none of those
|
|
CIDRs covers the node this pod lands on, the kubelet's probes are dropped
|
|
and THE POD NEVER BECOMES READY — the rollout then times out and the symptom
|
|
looks like a broken application. Compare
|
|
|
|
kubectl -n {{ .Release.Namespace }} describe pod -l app={{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
|
|
against `kubectl get node -o wide`.
|
|
{{- else }}
|
|
- THE PROBED PORT IS OPEN INSIDE THE CLUSTER. networkPolicy.probeSources is
|
|
empty, so that rule carries no source selector at all and any pod the CNI
|
|
routes to can reach it. Not from the internet — but this is NOT pod-level
|
|
isolation. Narrowing it means listing the worker node IPs in
|
|
networkPolicy.probeSources, because the kubelet probes from the node's own
|
|
address and the chart cannot know it; a wrong guess there leaves the pod
|
|
permanently un-Ready.
|
|
{{- end }}
|
|
- IT IS ONLY A BOUNDARY WHERE THE CNI ENFORCES POLICIES. Where it does not,
|
|
this object is accepted and filters nothing, so everything reads as
|
|
configured while nothing is filtered. `kubectl -n {{ .Release.Namespace }} get networkpolicy`
|
|
shows the object exists; only a connection attempt from an unrelated
|
|
namespace shows that it bites.
|
|
|
|
Switch it off with networkPolicy.enabled: false.
|
|
{{- end }}
|