diff --git a/charts/rhdh/Chart.yaml b/charts/rhdh/Chart.yaml index 3603c3f48..9fc318b89 100644 --- a/charts/rhdh/Chart.yaml +++ b/charts/rhdh/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: redhat-developer-hub type: application -version: 3.4.0 +version: 3.4.1 appVersion: 2.1.0 annotations: artifacthub.io/category: integration-delivery diff --git a/charts/rhdh/README.md b/charts/rhdh/README.md index cc55a0bdc..06475846e 100644 --- a/charts/rhdh/README.md +++ b/charts/rhdh/README.md @@ -1,7 +1,7 @@ # RHDH Helm Chart for OpenShift and Kubernetes -![Version: 3.4.0](https://img.shields.io/badge/Version-3.4.0-informational?style=flat-square) +![Version: 3.4.1](https://img.shields.io/badge/Version-3.4.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage. @@ -36,7 +36,7 @@ For the **Generally Available** version of this chart, see: helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart -helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.4.0 +helm install my-rhdh redhat-developer/redhat-developer-hub --version 3.4.1 ``` ## Introduction @@ -570,10 +570,11 @@ The following traffic is allowed out of the box: |-----------|------|----------------------|---------| | Egress | 53, 5353 (UDP/TCP) | Any | DNS resolution | | Egress | 443 (TCP) | Any | HTTPS (Git forges, auth providers, external APIs) | +| Egress | 80 (TCP) | In-cluster only (`namespaceSelector: {}`) | HTTP to in-cluster services (e.g., Keycloak without TLS termination) | | Egress | 5432 (TCP) | Built-in PostgreSQL pods (scoped) or any (external DB) | Database access | | Egress | 6379 (TCP) | Any | Redis (BYO — no pod/namespace selector) | -| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress | -| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback | +| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress (NP created only when OKP is enabled; disabled by default) | +| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback (NP created only when OKP is enabled; disabled by default) | | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | @@ -588,7 +589,7 @@ RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the c **Helm test NetworkPolicies** (`allow-test-connection` and `allow-test-connection-ingress`) are Helm test hooks: they are created just before `helm test` runs and cleaned up automatically on success. -**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing HTTP egress to an internal auth provider), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally: +**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing LDAP egress to an internal directory server), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally: ```yaml extraDeploy: @@ -596,7 +597,7 @@ extraDeploy: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{ include "rhdh.fullname" . }}-allow-http-egress + name: {{ include "rhdh.fullname" . }}-allow-ldap-egress spec: podSelector: matchLabels: @@ -605,7 +606,9 @@ extraDeploy: - Egress egress: - ports: - - port: 80 + - port: 389 + protocol: TCP + - port: 636 protocol: TCP ``` diff --git a/charts/rhdh/README.md.gotmpl b/charts/rhdh/README.md.gotmpl index aca399319..c7ec7763d 100644 --- a/charts/rhdh/README.md.gotmpl +++ b/charts/rhdh/README.md.gotmpl @@ -398,10 +398,11 @@ The following traffic is allowed out of the box: |-----------|------|----------------------|---------| | Egress | 53, 5353 (UDP/TCP) | Any | DNS resolution | | Egress | 443 (TCP) | Any | HTTPS (Git forges, auth providers, external APIs) | +| Egress | 80 (TCP) | In-cluster only (`namespaceSelector: {}`) | HTTP to in-cluster services (e.g., Keycloak without TLS termination) | | Egress | 5432 (TCP) | Built-in PostgreSQL pods (scoped) or any (external DB) | Database access | | Egress | 6379 (TCP) | Any | Redis (BYO — no pod/namespace selector) | -| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress | -| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback | +| Egress | 80 (TCP) | Any destination | LCORE access to an HTTP OKP Ingress (NP created only when OKP is enabled; disabled by default) | +| Egress | 8080 (TCP) | OKP pods | LCORE access to the internal OKP Service fallback (NP created only when OKP is enabled; disabled by default) | | Ingress | 7007 (TCP) | OpenShift router namespace or any namespace (non-OCP) | User traffic via Route / Ingress | | Ingress | 8080 (TCP) | RHDH pods and the OpenShift router namespace or any namespace (non-OCP) | OKP queries and product-document citations via Route / Ingress | | Ingress | 9464 (TCP) | `openshift-monitoring`, `openshift-user-workload-monitoring`, `gmp-system`, `gke-gmp-system`, `monitoring` | Prometheus metrics scraping | @@ -416,7 +417,7 @@ RHDH already permits HTTPS egress on port 443. When OKP uses HTTP instead, the c **Helm test NetworkPolicies** (`allow-test-connection` and `allow-test-connection-ingress`) are Helm test hooks: they are created just before `helm test` runs and cleaned up automatically on success. -**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing HTTP egress to an internal auth provider), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally: +**Adding your own NetworkPolicies.** Kubernetes evaluates NetworkPolicies additively — if any policy allows a connection, the connection is permitted. You **cannot** tighten an existing allow rule by adding another NetworkPolicy; you can only broaden access. To add extra allow rules (for example, allowing LDAP egress to an internal directory server), use [`extraDeploy`](#extra-deployed-resources-extradeploy) or apply your own NetworkPolicy resources externally: ```yaml extraDeploy: @@ -424,7 +425,7 @@ extraDeploy: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: {{"{{" }} include "rhdh.fullname" . {{"}}"}}-allow-http-egress + name: {{"{{" }} include "rhdh.fullname" . {{"}}"}}-allow-ldap-egress spec: podSelector: matchLabels: @@ -433,7 +434,9 @@ extraDeploy: - Egress egress: - ports: - - port: 80 + - port: 389 + protocol: TCP + - port: 636 protocol: TCP ``` diff --git a/charts/rhdh/templates/network-policies.yaml b/charts/rhdh/templates/network-policies.yaml index 5be32b576..baac07225 100644 --- a/charts/rhdh/templates/network-policies.yaml +++ b/charts/rhdh/templates/network-policies.yaml @@ -66,6 +66,33 @@ spec: - port: 443 protocol: TCP +--- +# Internal HTTP egress: plugins that talk to in-cluster services behind plain +# HTTP routes or services (e.g., Keycloak without TLS termination) need port 80. +# Restricted to cluster-internal destinations via namespaceSelector. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "rhdh.fullname" . }}-allow-http-egress + labels: + {{- include "rhdh.labels" . | nindent 4 }} + {{- with .Values.commonAnnotations }} + annotations: + {{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "rhdh.selectorLabels" . | nindent 6 }} + policyTypes: + - Egress + egress: + - to: + - namespaceSelector: {} + ports: + - port: 80 + protocol: TCP + --- # Redis is part of the recommended checklist for production deployments # (see https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.10/html/setting_up_and_configuring_your_first_red_hat_developer_hub_instance/checklist-to-run-your-first-rhdh-instance-in-production_setting-up-and-configuring-your-first-red-hat-developer-hub-instance).