From 049c51c4dd6429bac5afa9b1dda46bc11147bea5 Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Thu, 13 Aug 2026 14:49:06 +0200 Subject: [PATCH 1/8] fix: make default network policy compatible with Cilium dataplane Cilium resolves traffic to security identities and its CIDR selectors only match the `world` identity. Azure NPM matched raw addresses, so rules that work today stop matching once the dataplane changes. network-policy.yaml - add namespaceSelector/podSelector peers to both ipBlock rules. They sit inside the existing rules so they inherit the port lists and widen nothing. Without them, Traefik loses access to app pods: the policies do not name the traefik namespace and admit it only through ipBlock 0.0.0.0/0 matching Traefik's pod IP. cilium-network-policy.yaml - new, egress only. Node addresses resolve to the host / remote-node identities, which no ipBlock rule can match, and NPM's implicit pod-to-own-node allow does not carry over. Covers Azure IMDS at 169.254.169.254, which is link-local and resolves to `host`, so toCIDR would not match it. Rendered under the same switch as the NetworkPolicy. Also adds port 8443 alongside the long-standing 8433 typo in the external egress rule, and drops the unused redisCidr value. Tests reworked to match rules by content rather than list position, so adding a peer or a port no longer breaks every assertion below it. Requires the cilium.io/v2 CRD, so this chart version must only be consumed by clusters already running Azure CNI powered by Cilium. Co-Authored-By: Claude Opus 5 (1M context) --- charts/app-reverse-proxy/values.yaml | 1 - charts/core/Chart.yaml | 2 +- .../core/templates/cilium-network-policy.yaml | 45 +++ charts/core/templates/network-policy.yaml | 15 +- .../templates/tests/networkpolicy_test.py | 347 +++++++++++------- charts/core/values.yaml | 4 +- charts/cron-job/values.yaml | 1 - charts/dotnet-core/values.yaml | 1 - charts/event-worker/values.yaml | 1 - charts/job/values.yaml | 1 - 10 files changed, 266 insertions(+), 152 deletions(-) create mode 100644 charts/core/templates/cilium-network-policy.yaml diff --git a/charts/app-reverse-proxy/values.yaml b/charts/app-reverse-proxy/values.yaml index 78ff3f1..0bd5620 100644 --- a/charts/app-reverse-proxy/values.yaml +++ b/charts/app-reverse-proxy/values.yaml @@ -107,7 +107,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/core/Chart.yaml b/charts/core/Chart.yaml index 44dfd1d..04a64da 100644 --- a/charts/core/Chart.yaml +++ b/charts/core/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: charts-core description: A Helm chart for Kubernetes type: application -version: 2.8.0 +version: 2.9.0 diff --git a/charts/core/templates/cilium-network-policy.yaml b/charts/core/templates/cilium-network-policy.yaml new file mode 100644 index 0000000..4b565d8 --- /dev/null +++ b/charts/core/templates/cilium-network-policy.yaml @@ -0,0 +1,45 @@ +{{- if .Values.global.defaultNetworkPolicyEnabled -}} +{{/* + Egress to Node IPs. Kubernetes NetworkPolicy has no way to select a node, and + Cilium resolves node addresses to the `host` / `remote-node` identities, which + CIDR and ipBlock selectors never match. The ipBlock 0.0.0.0/0 rule in + network-policy.yaml therefore does NOT cover them, despite allowing every + address - a CIDR rule can only ever match the `world` identity. + + Azure NPM allowed a pod to reach its own node implicitly, so this never had to + be stated. Cilium grants nothing to nodes implicitly. + + The concrete dependency is Azure IMDS at 169.254.169.254, used for managed + identity. That address is link-local and resolves to `host`, so a toCIDR rule + would not match it either - toEntities is the only construct that works. + Workload Identity reaches AAD over 443 instead, which is `world` and already + allowed, but both paths are covered here. + + Egress only. These pods sit behind Traefik on a ClusterIP Service, so nothing + arrives from a node address. A workload exposed directly through a + LoadBalancer or NodePort Service with externalTrafficPolicy: Cluster sees the + client SNATed to a node IP and would additionally need + `fromEntities: [host, remote-node]`. + + Rendered under the same switch as the NetworkPolicy: a pod that is not policed + needs no CiliumNetworkPolicy either. + + Reference: + https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy +*/}} +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: {{ include "charts-core.fullname" . }}-node-egress + labels: + {{- include "charts-core.labels" . | nindent 4 }} + networkPolicyType: default +spec: + endpointSelector: + matchLabels: + {{- include "charts-core.selectorLabels" . | nindent 6 }} + egress: + - toEntities: + - host + - remote-node +{{- end -}} diff --git a/charts/core/templates/network-policy.yaml b/charts/core/templates/network-policy.yaml index a546a80..77c6924 100644 --- a/charts/core/templates/network-policy.yaml +++ b/charts/core/templates/network-policy.yaml @@ -37,6 +37,12 @@ spec: - from: #outside world - sentry, optimizely, etc - ipBlock: cidr: 0.0.0.0/0 + # Cilium never matches Pod IPs through ipBlock, so without these peers + # in-cluster clients lose access to the ports below. Under NPM they change + # nothing: 0.0.0.0/0 already covers Pods. Reference: + # https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy + - namespaceSelector: {} + - podSelector: {} ports: - port: 443 - port: 80 @@ -80,10 +86,17 @@ spec: - to: #outside world - sentry, optimizely, etc - ipBlock: cidr: 0.0.0.0/0 + # Cilium never matches Pod IPs through ipBlock, so without these peers + # in-cluster destinations lose access to the ports below. Under NPM they + # change nothing: 0.0.0.0/0 already covers Pods. + # https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy + - namespaceSelector: {} + - podSelector: {} ports: - port: 443 - port: 80 - - port: 8433 + - port: 8433 # DEPRECATED: typo for 8443, kept until confirmed unused + - port: 8443 - port: 8000 - port: 8200 - port: 53 diff --git a/charts/core/templates/tests/networkpolicy_test.py b/charts/core/templates/tests/networkpolicy_test.py index cd8f6be..27d88ef 100644 --- a/charts/core/templates/tests/networkpolicy_test.py +++ b/charts/core/templates/tests/networkpolicy_test.py @@ -1,170 +1,233 @@ import unittest -from os import remove -from os import sep -from os.path import dirname, realpath -from shutil import copyfile -import json + import jmespath from tests.helm_template_generator import render_chart -from tests.helm_template_generator import get_random_json_file_name -from tests.helm_template_generator import create_test_json_file -ROOT_FOLDER = realpath(dirname(realpath(__file__)) + "/..") +# --------------------------------------------------------------------------- +# Helpers +# +# These locate rules by what they contain rather than by their position in the +# list. Adding a port or a peer to the template used to break every assertion +# below it; now it only affects the assertions that actually care. +# --------------------------------------------------------------------------- -class NetworkPolicyTemplateFileTest(unittest.TestCase): +def render(**flags): + """Render the chart with defaultNetworkPolicyEnabled plus any extra flags.""" + values = {"global": dict({"defaultNetworkPolicyEnabled": True}, **flags)} + return render_chart( + values=values, + name=".", + show_only=["templates/network-policy.yaml"], + )[0] - def test_networkpolicy_rendering_zyte(self): - docs = render_chart( - values={ - "global": { - "defaultNetworkPolicyEnabled": True, - "redisNetworkPolicyEnabled": False, - "zyteProxyNetworkPolicyEnabled": True - } - }, - name=".", - show_only=["templates/network-policy.yaml"] - ) - self.assertRegex(docs[0]["kind"], "NetworkPolicy") - self.assertEqual( - {"port": 8010}, - jmespath.search("spec.egress[3].ports[7]", docs[0]) - ) - self.assertEqual( - {"port": 8011}, - jmespath.search("spec.egress[3].ports[8]", docs[0]) - ) - self.assertEqual( - {"port": 8014}, - jmespath.search("spec.egress[3].ports[9]", docs[0]) - ) - def test_mongodbnetworkpolicy(self): - docs = render_chart( - values={ - "global": { - "defaultNetworkPolicyEnabled": True, - "mongodbNetworkPolicyEnabled": True, - } - }, +def render_cilium(**flags): + values = {"global": dict({"defaultNetworkPolicyEnabled": True}, **flags)} + return render_chart( + values=values, name=".", - show_only=["templates/network-policy.yaml"] - ) - self.assertEqual( - {"port": 1024, - "endPort": 65535}, - jmespath.search( - "spec.egress[3].ports[7]", docs[0]) - ) + show_only=["templates/cilium-network-policy.yaml"], + )[0] - def test_strictmongodbnetworkpolicy(self): - docs = render_chart( - values={ - "global": { - "defaultNetworkPolicyEnabled": True, - "mongodbStrictNetworkPolicyEnabled": True, - } - }, - name=".", - show_only=["templates/network-policy.yaml"] - ) - self.assertEqual( - {"port": 27017}, - jmespath.search( - "spec.egress[3].ports[7]", docs[0]) - ) - def test_networkpolicy_rendering(self): - docs = render_chart( - values={ - "global": { - "defaultNetworkPolicyEnabled": True, - "redisNetworkPolicyEnabled": False - } - }, - name=".", - show_only=["templates/network-policy.yaml"] - ) - self.assertRegex(docs[0]["kind"], "NetworkPolicy") +def rules(doc, direction): + return jmespath.search("spec.%s" % direction, doc) or [] - def test_default_networkpolicy_rendering(self): - docs = render_chart( - values={ - "global": { - "defaultNetworkPolicyEnabled": True, - "redisNetworkPolicyEnabled": True, - "postgresNetworkPolicyEnabled": True - } - }, - name=".", - show_only=["templates/network-policy.yaml"] - ) - self.assertRegex(docs[0]["kind"], "NetworkPolicy") - self.assertIsNotNone( - jmespath.search("spec.ingress[0].from[0].podSelector", docs[0]) - ) - self.assertIsNotNone( - jmespath.search( - "spec.ingress[1].from[0].namespaceSelector", docs[0]) - ) - self.assertEqual( - "default", - jmespath.search( - "spec.ingress[1].from[0].namespaceSelector.matchLabels.environment", docs[0]) - ) - self.assertIsNotNone( - jmespath.search("spec.ingress[2].from[0].ipBlock", docs[0]) - ) +def peers(rule, direction): + return rule.get("to" if direction == "egress" else "from") or [] - self.assertEqual( - {"port": 443}, - jmespath.search("spec.ingress[2].ports[0]", docs[0]) - ) - self.assertEqual( - {"port": 80}, - jmespath.search("spec.ingress[2].ports[1]", docs[0]) - ) +def rule_with_ipblock(doc, direction, cidr="0.0.0.0/0"): + """The rule whose peer list contains the given CIDR, or None.""" + for rule in rules(doc, direction): + for peer in peers(rule, direction): + if (peer.get("ipBlock") or {}).get("cidr") == cidr: + return rule + return None - self.assertEqual( - {"port": 8443}, - jmespath.search("spec.ingress[2].ports[2]", docs[0]) - ) - self.assertEqual( - {"port": 8000}, - jmespath.search("spec.ingress[2].ports[3]", docs[0]) - ) +def rule_with_namespace_label(doc, direction, key, value): + for rule in rules(doc, direction): + for peer in peers(rule, direction): + labels = (peer.get("namespaceSelector") or {}).get("matchLabels") or {} + if labels.get(key) == value: + return rule + return None - self.assertIsNotNone( - jmespath.search("spec.egress[0].to[0].podSelector", docs[0]) - ) - self.assertIsNotNone( - jmespath.search("spec.egress[1].to[0].namespaceSelector", docs[0]) - ) +def rule_with_pod_labels(doc, direction, labels): + for rule in rules(doc, direction): + for peer in peers(rule, direction): + if (peer.get("podSelector") or {}).get("matchLabels") == labels: + return rule + return None - self.assertEqual( - {"k8s-app": "kube-dns"}, - jmespath.search( - "spec.egress[1].to[0].podSelector.matchLabels", docs[0]) - ) - self.assertEqual( - {'port': 53, 'protocol': 'UDP'}, - jmespath.search("spec.egress[1].ports[0]", docs[0]) +def intra_namespace_rule(doc, direction): + """The `podSelector: {}` catch-all rule for the current namespace.""" + for rule in rules(doc, direction): + peer_list = peers(rule, direction) + if len(peer_list) == 1 and peer_list[0] == {"podSelector": {}}: + return rule + return None + + +def port_numbers(rule): + return {p["port"] for p in (rule or {}).get("ports", []) if "port" in p} + + +def has_port(rule, port, protocol=None, end_port=None): + for entry in (rule or {}).get("ports", []): + if entry.get("port") != port: + continue + if protocol is not None and entry.get("protocol") != protocol: + continue + if end_port is not None and entry.get("endPort") != end_port: + continue + return True + return False + + +def peer_kinds(rule, direction): + """Set of peer types present on a rule, e.g. {"ipBlock", "podSelector"}.""" + kinds = set() + for peer in peers(rule, direction): + kinds.update(peer.keys()) + return kinds + + +class NetworkPolicyTemplateFileTest(unittest.TestCase): + + # -- rendering / structure --------------------------------------------- + + def test_networkpolicy_is_rendered(self): + doc = render(redisNetworkPolicyEnabled=False) + self.assertEqual("NetworkPolicy", doc["kind"]) + self.assertEqual("networking.k8s.io/v1", doc["apiVersion"]) + + def test_policy_is_absent_when_disabled(self): + # Rendered without --show-only: helm treats an unmatched --show-only as + # an error, so we render the whole chart and look for the kind instead. + docs = render_chart( + values={"global": {"defaultNetworkPolicyEnabled": False}}, + name=".", ) + self.assertEqual([], [d for d in docs if d.get("kind") == "NetworkPolicy"]) + def test_intra_namespace_traffic_is_allowed_both_ways(self): + doc = render() + self.assertIsNotNone(intra_namespace_rule(doc, "ingress")) + self.assertIsNotNone(intra_namespace_rule(doc, "egress")) + + def test_environment_namespace_selector(self): + # Release namespace defaults to "default", so environment == "default". + doc = render() + self.assertIsNotNone( + rule_with_namespace_label(doc, "ingress", "environment", "default")) + egress = rule_with_namespace_label(doc, "egress", "environment", "default") + self.assertIsNotNone(egress) + self.assertEqual({8443, 8000, 80, 443}, port_numbers(egress)) + + def test_kube_dns_egress(self): + doc = render() + rule = rule_with_pod_labels(doc, "egress", {"k8s-app": "kube-dns"}) + self.assertIsNotNone(rule) + self.assertTrue(has_port(rule, 53, protocol="UDP")) + + # -- the external (ipBlock) rules --------------------------------------- + + def test_external_ingress_ports(self): + doc = render(redisNetworkPolicyEnabled=True, postgresNetworkPolicyEnabled=True) + rule = rule_with_ipblock(doc, "ingress") + self.assertIsNotNone(rule) + self.assertTrue({443, 80, 8443, 8000}.issubset(port_numbers(rule))) + + def test_external_egress_covers_both_tls_ports(self): + # 8433 is a long-standing typo for 8443; both are allowed until the + # former is confirmed unused. See charts/core/README.md. + rule = rule_with_ipblock(render(), "egress") + self.assertTrue({8433, 8443}.issubset(port_numbers(rule))) + + def test_postgres_port_opt_in(self): + self.assertNotIn(5432, port_numbers(rule_with_ipblock(render(), "egress"))) + rule = rule_with_ipblock(render(postgresNetworkPolicyEnabled=True), "egress") + self.assertIn(5432, port_numbers(rule)) + + def test_zyte_proxy_ports_opt_in(self): + doc = render(redisNetworkPolicyEnabled=False, zyteProxyNetworkPolicyEnabled=True) + rule = rule_with_ipblock(doc, "egress") + self.assertTrue({8010, 8011, 8014}.issubset(port_numbers(rule))) + + def test_mongodb_wide_range_opt_in(self): + rule = rule_with_ipblock(render(mongodbNetworkPolicyEnabled=True), "egress") + self.assertTrue(has_port(rule, 1024, end_port=65535)) + + def test_mongodb_strict_uses_single_port(self): + rule = rule_with_ipblock( + render(mongodbStrictNetworkPolicyEnabled=True), "egress") + self.assertIn(27017, port_numbers(rule)) + self.assertFalse(has_port(rule, 1024, end_port=65535)) + + def test_sql_redirect_port_range_opt_in(self): + rule = rule_with_ipblock(render(sqlNetworkPolicyEnabled=True), "egress") + self.assertIn(1433, port_numbers(rule)) + self.assertTrue(has_port(rule, 11000, end_port=11999)) + + # -- Cilium compatibility ---------------------------------------------- + + def test_ipblock_rules_carry_selector_peers(self): + # Cilium never matches Pod IPs through ipBlock, so the same ports have + # to be reachable via selectors for in-cluster peers. + doc = render() + for direction in ("egress", "ingress"): + rule = rule_with_ipblock(doc, direction) + self.assertEqual( + {"ipBlock", "namespaceSelector", "podSelector"}, + peer_kinds(rule, direction), + "%s ipBlock rule is missing selector peers" % direction, + ) + + def test_node_egress_policy_allows_host_entities(self): + # ipBlock cannot match node addresses under Cilium, so IMDS + # (169.254.169.254, link-local -> `host`) needs an entity rule. + doc = render_cilium() + self.assertEqual("CiliumNetworkPolicy", doc["kind"]) + self.assertEqual("cilium.io/v2", doc["apiVersion"]) + entities = jmespath.search("spec.egress[0].toEntities", doc) + self.assertEqual(["host", "remote-node"], entities) + + def test_node_egress_policy_targets_the_same_pods(self): + np = render() + cnp = render_cilium() self.assertEqual( - {'port': 5432}, - jmespath.search("spec.egress[3].ports[7]", docs[0]) + jmespath.search("spec.podSelector.matchLabels", np), + jmespath.search("spec.endpointSelector.matchLabels", cnp), ) + def test_node_egress_policy_declares_no_ingress(self): + # Deliberate: these pods sit behind Traefik on a ClusterIP Service, so + # nothing reaches them from a node address. + self.assertNotIn("ingress", render_cilium()["spec"]) + + def test_node_egress_policy_follows_the_networkpolicy_switch(self): + docs = render_chart( + values={"global": {"defaultNetworkPolicyEnabled": False}}, + name=".", + ) self.assertEqual( - "default", - jmespath.search( - "spec.egress[2].to[0].namespaceSelector.matchLabels.environment", docs[0]) - ) \ No newline at end of file + [], [d for d in docs if d.get("kind") == "CiliumNetworkPolicy"]) + + def test_selector_peers_do_not_widen_the_port_list(self): + # The selector peers must sit inside the existing rule so they inherit + # its ports; a separate peerless rule would allow every port. + doc = render(postgresNetworkPolicyEnabled=True, redisNetworkPolicyEnabled=True) + rule = rule_with_ipblock(doc, "egress") + self.assertTrue(port_numbers(rule), "external egress rule lost its ports") + for candidate in rules(doc, "egress"): + self.assertTrue( + peers(candidate, "egress"), + "found an egress rule with no peers - that allows all destinations", + ) diff --git a/charts/core/values.yaml b/charts/core/values.yaml index e508d94..ddcb469 100644 --- a/charts/core/values.yaml +++ b/charts/core/values.yaml @@ -62,9 +62,7 @@ global: servicebusNetworkPolicyEnabled: true redisNetworkPolicyEnabled: true cosmosNetworkPolicyEnabled: false - - redisCidr: "" - + service: enabled: true type: ClusterIP diff --git a/charts/cron-job/values.yaml b/charts/cron-job/values.yaml index 84262ec..c441548 100644 --- a/charts/cron-job/values.yaml +++ b/charts/cron-job/values.yaml @@ -103,7 +103,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/dotnet-core/values.yaml b/charts/dotnet-core/values.yaml index 51e5058..4b0ca7e 100644 --- a/charts/dotnet-core/values.yaml +++ b/charts/dotnet-core/values.yaml @@ -126,7 +126,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/event-worker/values.yaml b/charts/event-worker/values.yaml index 26173dd..949926b 100644 --- a/charts/event-worker/values.yaml +++ b/charts/event-worker/values.yaml @@ -66,7 +66,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: false - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/job/values.yaml b/charts/job/values.yaml index 5e17302..53dbb89 100644 --- a/charts/job/values.yaml +++ b/charts/job/values.yaml @@ -70,7 +70,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true From 7ee5166d107243edae360904018a4b8ed997d4a6 Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Fri, 14 Aug 2026 09:56:09 +0200 Subject: [PATCH 2/8] versioning fix --- charts/app-reverse-proxy/Chart.yaml | 4 ++-- charts/core/Chart.yaml | 2 +- charts/cron-job/Chart.yaml | 4 ++-- charts/dotnet-core/Chart.yaml | 4 ++-- charts/event-worker/Chart.yaml | 4 ++-- charts/job/Chart.yaml | 4 ++-- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/charts/app-reverse-proxy/Chart.yaml b/charts/app-reverse-proxy/Chart.yaml index acbf924..b258cd2 100644 --- a/charts/app-reverse-proxy/Chart.yaml +++ b/charts/app-reverse-proxy/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: charts-app-reverse-proxy description: EcoVadis Helm chart for application exposed with nginx reverse proxy type: application -version: 3.1.1 +version: 4.0.0 appVersion: 1.16.0 dependencies: - name: charts-core - version: 2.6.0 + version: 3.0.0 repository: "https://ecovadiscode.github.io/charts/" diff --git a/charts/core/Chart.yaml b/charts/core/Chart.yaml index 04a64da..b195281 100644 --- a/charts/core/Chart.yaml +++ b/charts/core/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: charts-core description: A Helm chart for Kubernetes type: application -version: 2.9.0 +version: 3.0.0 diff --git a/charts/cron-job/Chart.yaml b/charts/cron-job/Chart.yaml index 722b839..ea9cbbf 100644 --- a/charts/cron-job/Chart.yaml +++ b/charts/cron-job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Cron Job name: charts-cron-job type: application -version: 2.11.1 +version: 3.0.0 dependencies: - name: charts-core - version: 2.4.2 + version: 3.0.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/dotnet-core/Chart.yaml b/charts/dotnet-core/Chart.yaml index bfb9d2a..7854559 100644 --- a/charts/dotnet-core/Chart.yaml +++ b/charts/dotnet-core/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for .Net Core app name: charts-dotnet-core type: application -version: 4.11.0 +version: 5.0.0 dependencies: - name: charts-core - version: "2.8.0" + version: "3.0.0" repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/event-worker/Chart.yaml b/charts/event-worker/Chart.yaml index 1673b0d..3bf1607 100644 --- a/charts/event-worker/Chart.yaml +++ b/charts/event-worker/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Deployment name: charts-event-worker type: application -version: 1.6.0 +version: 2.0.0 dependencies: - name: charts-core - version: 2.7.0 + version: 3.0.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/job/Chart.yaml b/charts/job/Chart.yaml index 23ba57f..8aa0e50 100644 --- a/charts/job/Chart.yaml +++ b/charts/job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Job name: charts-job type: application -version: 2.9.2 +version: 3.0.0 dependencies: - name: charts-core - version: 2.4.2 + version: 3.0.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file From ed9cd9348e069768c1106e8d259e67f35bf52f5f Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Mon, 7 Sep 2026 15:17:18 +0200 Subject: [PATCH 3/8] reverted test and removed not needed CNP --- .../core/templates/cilium-network-policy.yaml | 45 --- charts/core/templates/network-policy.yaml | 3 +- .../templates/tests/networkpolicy_test.py | 347 +++++++----------- 3 files changed, 143 insertions(+), 252 deletions(-) delete mode 100644 charts/core/templates/cilium-network-policy.yaml diff --git a/charts/core/templates/cilium-network-policy.yaml b/charts/core/templates/cilium-network-policy.yaml deleted file mode 100644 index 4b565d8..0000000 --- a/charts/core/templates/cilium-network-policy.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.global.defaultNetworkPolicyEnabled -}} -{{/* - Egress to Node IPs. Kubernetes NetworkPolicy has no way to select a node, and - Cilium resolves node addresses to the `host` / `remote-node` identities, which - CIDR and ipBlock selectors never match. The ipBlock 0.0.0.0/0 rule in - network-policy.yaml therefore does NOT cover them, despite allowing every - address - a CIDR rule can only ever match the `world` identity. - - Azure NPM allowed a pod to reach its own node implicitly, so this never had to - be stated. Cilium grants nothing to nodes implicitly. - - The concrete dependency is Azure IMDS at 169.254.169.254, used for managed - identity. That address is link-local and resolves to `host`, so a toCIDR rule - would not match it either - toEntities is the only construct that works. - Workload Identity reaches AAD over 443 instead, which is `world` and already - allowed, but both paths are covered here. - - Egress only. These pods sit behind Traefik on a ClusterIP Service, so nothing - arrives from a node address. A workload exposed directly through a - LoadBalancer or NodePort Service with externalTrafficPolicy: Cluster sees the - client SNATed to a node IP and would additionally need - `fromEntities: [host, remote-node]`. - - Rendered under the same switch as the NetworkPolicy: a pod that is not policed - needs no CiliumNetworkPolicy either. - - Reference: - https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy -*/}} -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: {{ include "charts-core.fullname" . }}-node-egress - labels: - {{- include "charts-core.labels" . | nindent 4 }} - networkPolicyType: default -spec: - endpointSelector: - matchLabels: - {{- include "charts-core.selectorLabels" . | nindent 6 }} - egress: - - toEntities: - - host - - remote-node -{{- end -}} diff --git a/charts/core/templates/network-policy.yaml b/charts/core/templates/network-policy.yaml index 77c6924..f676859 100644 --- a/charts/core/templates/network-policy.yaml +++ b/charts/core/templates/network-policy.yaml @@ -95,8 +95,7 @@ spec: ports: - port: 443 - port: 80 - - port: 8433 # DEPRECATED: typo for 8443, kept until confirmed unused - - port: 8443 + - port: 8433 - port: 8000 - port: 8200 - port: 53 diff --git a/charts/core/templates/tests/networkpolicy_test.py b/charts/core/templates/tests/networkpolicy_test.py index 27d88ef..cd8f6be 100644 --- a/charts/core/templates/tests/networkpolicy_test.py +++ b/charts/core/templates/tests/networkpolicy_test.py @@ -1,233 +1,170 @@ import unittest - +from os import remove +from os import sep +from os.path import dirname, realpath +from shutil import copyfile +import json import jmespath from tests.helm_template_generator import render_chart +from tests.helm_template_generator import get_random_json_file_name +from tests.helm_template_generator import create_test_json_file +ROOT_FOLDER = realpath(dirname(realpath(__file__)) + "/..") -# --------------------------------------------------------------------------- -# Helpers -# -# These locate rules by what they contain rather than by their position in the -# list. Adding a port or a peer to the template used to break every assertion -# below it; now it only affects the assertions that actually care. -# --------------------------------------------------------------------------- -def render(**flags): - """Render the chart with defaultNetworkPolicyEnabled plus any extra flags.""" - values = {"global": dict({"defaultNetworkPolicyEnabled": True}, **flags)} - return render_chart( - values=values, - name=".", - show_only=["templates/network-policy.yaml"], - )[0] +class NetworkPolicyTemplateFileTest(unittest.TestCase): + def test_networkpolicy_rendering_zyte(self): + docs = render_chart( + values={ + "global": { + "defaultNetworkPolicyEnabled": True, + "redisNetworkPolicyEnabled": False, + "zyteProxyNetworkPolicyEnabled": True + } + }, + name=".", + show_only=["templates/network-policy.yaml"] + ) + self.assertRegex(docs[0]["kind"], "NetworkPolicy") + self.assertEqual( + {"port": 8010}, + jmespath.search("spec.egress[3].ports[7]", docs[0]) + ) + self.assertEqual( + {"port": 8011}, + jmespath.search("spec.egress[3].ports[8]", docs[0]) + ) + self.assertEqual( + {"port": 8014}, + jmespath.search("spec.egress[3].ports[9]", docs[0]) + ) -def render_cilium(**flags): - values = {"global": dict({"defaultNetworkPolicyEnabled": True}, **flags)} - return render_chart( - values=values, + def test_mongodbnetworkpolicy(self): + docs = render_chart( + values={ + "global": { + "defaultNetworkPolicyEnabled": True, + "mongodbNetworkPolicyEnabled": True, + } + }, name=".", - show_only=["templates/cilium-network-policy.yaml"], - )[0] - - -def rules(doc, direction): - return jmespath.search("spec.%s" % direction, doc) or [] - - -def peers(rule, direction): - return rule.get("to" if direction == "egress" else "from") or [] - - -def rule_with_ipblock(doc, direction, cidr="0.0.0.0/0"): - """The rule whose peer list contains the given CIDR, or None.""" - for rule in rules(doc, direction): - for peer in peers(rule, direction): - if (peer.get("ipBlock") or {}).get("cidr") == cidr: - return rule - return None - - -def rule_with_namespace_label(doc, direction, key, value): - for rule in rules(doc, direction): - for peer in peers(rule, direction): - labels = (peer.get("namespaceSelector") or {}).get("matchLabels") or {} - if labels.get(key) == value: - return rule - return None - - -def rule_with_pod_labels(doc, direction, labels): - for rule in rules(doc, direction): - for peer in peers(rule, direction): - if (peer.get("podSelector") or {}).get("matchLabels") == labels: - return rule - return None - - -def intra_namespace_rule(doc, direction): - """The `podSelector: {}` catch-all rule for the current namespace.""" - for rule in rules(doc, direction): - peer_list = peers(rule, direction) - if len(peer_list) == 1 and peer_list[0] == {"podSelector": {}}: - return rule - return None - - -def port_numbers(rule): - return {p["port"] for p in (rule or {}).get("ports", []) if "port" in p} - + show_only=["templates/network-policy.yaml"] + ) + self.assertEqual( + {"port": 1024, + "endPort": 65535}, + jmespath.search( + "spec.egress[3].ports[7]", docs[0]) + ) -def has_port(rule, port, protocol=None, end_port=None): - for entry in (rule or {}).get("ports", []): - if entry.get("port") != port: - continue - if protocol is not None and entry.get("protocol") != protocol: - continue - if end_port is not None and entry.get("endPort") != end_port: - continue - return True - return False + def test_strictmongodbnetworkpolicy(self): + docs = render_chart( + values={ + "global": { + "defaultNetworkPolicyEnabled": True, + "mongodbStrictNetworkPolicyEnabled": True, + } + }, + name=".", + show_only=["templates/network-policy.yaml"] + ) + self.assertEqual( + {"port": 27017}, + jmespath.search( + "spec.egress[3].ports[7]", docs[0]) + ) + def test_networkpolicy_rendering(self): + docs = render_chart( + values={ + "global": { + "defaultNetworkPolicyEnabled": True, + "redisNetworkPolicyEnabled": False + } + }, + name=".", + show_only=["templates/network-policy.yaml"] + ) + self.assertRegex(docs[0]["kind"], "NetworkPolicy") -def peer_kinds(rule, direction): - """Set of peer types present on a rule, e.g. {"ipBlock", "podSelector"}.""" - kinds = set() - for peer in peers(rule, direction): - kinds.update(peer.keys()) - return kinds + def test_default_networkpolicy_rendering(self): + docs = render_chart( + values={ + "global": { + "defaultNetworkPolicyEnabled": True, + "redisNetworkPolicyEnabled": True, + "postgresNetworkPolicyEnabled": True + } + }, + name=".", + show_only=["templates/network-policy.yaml"] + ) + self.assertRegex(docs[0]["kind"], "NetworkPolicy") + self.assertIsNotNone( + jmespath.search("spec.ingress[0].from[0].podSelector", docs[0]) + ) + self.assertIsNotNone( + jmespath.search( + "spec.ingress[1].from[0].namespaceSelector", docs[0]) + ) + self.assertEqual( + "default", + jmespath.search( + "spec.ingress[1].from[0].namespaceSelector.matchLabels.environment", docs[0]) + ) + self.assertIsNotNone( + jmespath.search("spec.ingress[2].from[0].ipBlock", docs[0]) + ) -class NetworkPolicyTemplateFileTest(unittest.TestCase): + self.assertEqual( + {"port": 443}, + jmespath.search("spec.ingress[2].ports[0]", docs[0]) + ) - # -- rendering / structure --------------------------------------------- + self.assertEqual( + {"port": 80}, + jmespath.search("spec.ingress[2].ports[1]", docs[0]) + ) - def test_networkpolicy_is_rendered(self): - doc = render(redisNetworkPolicyEnabled=False) - self.assertEqual("NetworkPolicy", doc["kind"]) - self.assertEqual("networking.k8s.io/v1", doc["apiVersion"]) + self.assertEqual( + {"port": 8443}, + jmespath.search("spec.ingress[2].ports[2]", docs[0]) + ) - def test_policy_is_absent_when_disabled(self): - # Rendered without --show-only: helm treats an unmatched --show-only as - # an error, so we render the whole chart and look for the kind instead. - docs = render_chart( - values={"global": {"defaultNetworkPolicyEnabled": False}}, - name=".", + self.assertEqual( + {"port": 8000}, + jmespath.search("spec.ingress[2].ports[3]", docs[0]) ) - self.assertEqual([], [d for d in docs if d.get("kind") == "NetworkPolicy"]) - def test_intra_namespace_traffic_is_allowed_both_ways(self): - doc = render() - self.assertIsNotNone(intra_namespace_rule(doc, "ingress")) - self.assertIsNotNone(intra_namespace_rule(doc, "egress")) + self.assertIsNotNone( + jmespath.search("spec.egress[0].to[0].podSelector", docs[0]) + ) - def test_environment_namespace_selector(self): - # Release namespace defaults to "default", so environment == "default". - doc = render() self.assertIsNotNone( - rule_with_namespace_label(doc, "ingress", "environment", "default")) - egress = rule_with_namespace_label(doc, "egress", "environment", "default") - self.assertIsNotNone(egress) - self.assertEqual({8443, 8000, 80, 443}, port_numbers(egress)) - - def test_kube_dns_egress(self): - doc = render() - rule = rule_with_pod_labels(doc, "egress", {"k8s-app": "kube-dns"}) - self.assertIsNotNone(rule) - self.assertTrue(has_port(rule, 53, protocol="UDP")) - - # -- the external (ipBlock) rules --------------------------------------- - - def test_external_ingress_ports(self): - doc = render(redisNetworkPolicyEnabled=True, postgresNetworkPolicyEnabled=True) - rule = rule_with_ipblock(doc, "ingress") - self.assertIsNotNone(rule) - self.assertTrue({443, 80, 8443, 8000}.issubset(port_numbers(rule))) - - def test_external_egress_covers_both_tls_ports(self): - # 8433 is a long-standing typo for 8443; both are allowed until the - # former is confirmed unused. See charts/core/README.md. - rule = rule_with_ipblock(render(), "egress") - self.assertTrue({8433, 8443}.issubset(port_numbers(rule))) - - def test_postgres_port_opt_in(self): - self.assertNotIn(5432, port_numbers(rule_with_ipblock(render(), "egress"))) - rule = rule_with_ipblock(render(postgresNetworkPolicyEnabled=True), "egress") - self.assertIn(5432, port_numbers(rule)) - - def test_zyte_proxy_ports_opt_in(self): - doc = render(redisNetworkPolicyEnabled=False, zyteProxyNetworkPolicyEnabled=True) - rule = rule_with_ipblock(doc, "egress") - self.assertTrue({8010, 8011, 8014}.issubset(port_numbers(rule))) - - def test_mongodb_wide_range_opt_in(self): - rule = rule_with_ipblock(render(mongodbNetworkPolicyEnabled=True), "egress") - self.assertTrue(has_port(rule, 1024, end_port=65535)) - - def test_mongodb_strict_uses_single_port(self): - rule = rule_with_ipblock( - render(mongodbStrictNetworkPolicyEnabled=True), "egress") - self.assertIn(27017, port_numbers(rule)) - self.assertFalse(has_port(rule, 1024, end_port=65535)) - - def test_sql_redirect_port_range_opt_in(self): - rule = rule_with_ipblock(render(sqlNetworkPolicyEnabled=True), "egress") - self.assertIn(1433, port_numbers(rule)) - self.assertTrue(has_port(rule, 11000, end_port=11999)) - - # -- Cilium compatibility ---------------------------------------------- - - def test_ipblock_rules_carry_selector_peers(self): - # Cilium never matches Pod IPs through ipBlock, so the same ports have - # to be reachable via selectors for in-cluster peers. - doc = render() - for direction in ("egress", "ingress"): - rule = rule_with_ipblock(doc, direction) - self.assertEqual( - {"ipBlock", "namespaceSelector", "podSelector"}, - peer_kinds(rule, direction), - "%s ipBlock rule is missing selector peers" % direction, - ) - - def test_node_egress_policy_allows_host_entities(self): - # ipBlock cannot match node addresses under Cilium, so IMDS - # (169.254.169.254, link-local -> `host`) needs an entity rule. - doc = render_cilium() - self.assertEqual("CiliumNetworkPolicy", doc["kind"]) - self.assertEqual("cilium.io/v2", doc["apiVersion"]) - entities = jmespath.search("spec.egress[0].toEntities", doc) - self.assertEqual(["host", "remote-node"], entities) - - def test_node_egress_policy_targets_the_same_pods(self): - np = render() - cnp = render_cilium() + jmespath.search("spec.egress[1].to[0].namespaceSelector", docs[0]) + ) + self.assertEqual( - jmespath.search("spec.podSelector.matchLabels", np), - jmespath.search("spec.endpointSelector.matchLabels", cnp), + {"k8s-app": "kube-dns"}, + jmespath.search( + "spec.egress[1].to[0].podSelector.matchLabels", docs[0]) ) - def test_node_egress_policy_declares_no_ingress(self): - # Deliberate: these pods sit behind Traefik on a ClusterIP Service, so - # nothing reaches them from a node address. - self.assertNotIn("ingress", render_cilium()["spec"]) + self.assertEqual( + {'port': 53, 'protocol': 'UDP'}, + jmespath.search("spec.egress[1].ports[0]", docs[0]) + ) - def test_node_egress_policy_follows_the_networkpolicy_switch(self): - docs = render_chart( - values={"global": {"defaultNetworkPolicyEnabled": False}}, - name=".", + self.assertEqual( + {'port': 5432}, + jmespath.search("spec.egress[3].ports[7]", docs[0]) ) + self.assertEqual( - [], [d for d in docs if d.get("kind") == "CiliumNetworkPolicy"]) - - def test_selector_peers_do_not_widen_the_port_list(self): - # The selector peers must sit inside the existing rule so they inherit - # its ports; a separate peerless rule would allow every port. - doc = render(postgresNetworkPolicyEnabled=True, redisNetworkPolicyEnabled=True) - rule = rule_with_ipblock(doc, "egress") - self.assertTrue(port_numbers(rule), "external egress rule lost its ports") - for candidate in rules(doc, "egress"): - self.assertTrue( - peers(candidate, "egress"), - "found an egress rule with no peers - that allows all destinations", - ) + "default", + jmespath.search( + "spec.egress[2].to[0].namespaceSelector.matchLabels.environment", docs[0]) + ) \ No newline at end of file From f77b8a424d9c8f991714cfb55824e36eaf0efbbf Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Mon, 7 Sep 2026 15:20:58 +0200 Subject: [PATCH 4/8] fixed semver since change is backward compatible --- charts/core/Chart.yaml | 2 +- charts/cron-job/Chart.yaml | 4 ++-- charts/dotnet-core/Chart.yaml | 4 ++-- charts/event-worker/Chart.yaml | 4 ++-- charts/job/Chart.yaml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/charts/core/Chart.yaml b/charts/core/Chart.yaml index b195281..04a64da 100644 --- a/charts/core/Chart.yaml +++ b/charts/core/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: charts-core description: A Helm chart for Kubernetes type: application -version: 3.0.0 +version: 2.9.0 diff --git a/charts/cron-job/Chart.yaml b/charts/cron-job/Chart.yaml index ea9cbbf..fa03d92 100644 --- a/charts/cron-job/Chart.yaml +++ b/charts/cron-job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Cron Job name: charts-cron-job type: application -version: 3.0.0 +version: 2.12.0 dependencies: - name: charts-core - version: 3.0.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/dotnet-core/Chart.yaml b/charts/dotnet-core/Chart.yaml index 7854559..eb4c217 100644 --- a/charts/dotnet-core/Chart.yaml +++ b/charts/dotnet-core/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for .Net Core app name: charts-dotnet-core type: application -version: 5.0.0 +version: 4.12.0 dependencies: - name: charts-core - version: "3.0.0" + version: "2.9.0" repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/event-worker/Chart.yaml b/charts/event-worker/Chart.yaml index 3bf1607..fee0850 100644 --- a/charts/event-worker/Chart.yaml +++ b/charts/event-worker/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Deployment name: charts-event-worker type: application -version: 2.0.0 +version: 1.7.0 dependencies: - name: charts-core - version: 3.0.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/job/Chart.yaml b/charts/job/Chart.yaml index 8aa0e50..930d1ad 100644 --- a/charts/job/Chart.yaml +++ b/charts/job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Job name: charts-job type: application -version: 3.0.0 +version: 2.10.0 dependencies: - name: charts-core - version: 3.0.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file From 53b75ebd60433468ab8a4a959316ea02cb76c5ec Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Mon, 7 Sep 2026 15:21:51 +0200 Subject: [PATCH 5/8] one more fix in semver --- charts/app-reverse-proxy/Chart.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/app-reverse-proxy/Chart.yaml b/charts/app-reverse-proxy/Chart.yaml index b258cd2..a255372 100644 --- a/charts/app-reverse-proxy/Chart.yaml +++ b/charts/app-reverse-proxy/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: charts-app-reverse-proxy description: EcoVadis Helm chart for application exposed with nginx reverse proxy type: application -version: 4.0.0 +version: 3.2.0 appVersion: 1.16.0 dependencies: - name: charts-core - version: 3.0.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" From 809ae5b1a74cab84ee776d8828b2e55edad6135b Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Wed, 9 Sep 2026 14:23:43 +0200 Subject: [PATCH 6/8] chore: defer consumer chart bumps until core is verified Keeps this branch to charts/core and charts/dotnet-core only, so the backward compatibility of the network policy change can be tested against an Azure NPM cluster without dragging every consumer chart along. The app-reverse-proxy, cron-job, event-worker and job bumps - version increments plus removal of the unused redisCidr value - are held in a local stash and will be reapplied once core is verified. Co-Authored-By: Claude Opus 5 (1M context) --- charts/app-reverse-proxy/Chart.yaml | 4 ++-- charts/app-reverse-proxy/values.yaml | 1 + charts/cron-job/Chart.yaml | 4 ++-- charts/cron-job/values.yaml | 1 + charts/event-worker/Chart.yaml | 4 ++-- charts/event-worker/values.yaml | 1 + charts/job/Chart.yaml | 4 ++-- charts/job/values.yaml | 1 + 8 files changed, 12 insertions(+), 8 deletions(-) diff --git a/charts/app-reverse-proxy/Chart.yaml b/charts/app-reverse-proxy/Chart.yaml index a255372..acbf924 100644 --- a/charts/app-reverse-proxy/Chart.yaml +++ b/charts/app-reverse-proxy/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: charts-app-reverse-proxy description: EcoVadis Helm chart for application exposed with nginx reverse proxy type: application -version: 3.2.0 +version: 3.1.1 appVersion: 1.16.0 dependencies: - name: charts-core - version: 2.9.0 + version: 2.6.0 repository: "https://ecovadiscode.github.io/charts/" diff --git a/charts/app-reverse-proxy/values.yaml b/charts/app-reverse-proxy/values.yaml index 0bd5620..78ff3f1 100644 --- a/charts/app-reverse-proxy/values.yaml +++ b/charts/app-reverse-proxy/values.yaml @@ -107,6 +107,7 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true + redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/cron-job/Chart.yaml b/charts/cron-job/Chart.yaml index fa03d92..722b839 100644 --- a/charts/cron-job/Chart.yaml +++ b/charts/cron-job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Cron Job name: charts-cron-job type: application -version: 2.12.0 +version: 2.11.1 dependencies: - name: charts-core - version: 2.9.0 + version: 2.4.2 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/cron-job/values.yaml b/charts/cron-job/values.yaml index c441548..84262ec 100644 --- a/charts/cron-job/values.yaml +++ b/charts/cron-job/values.yaml @@ -103,6 +103,7 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true + redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/event-worker/Chart.yaml b/charts/event-worker/Chart.yaml index fee0850..1673b0d 100644 --- a/charts/event-worker/Chart.yaml +++ b/charts/event-worker/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Deployment name: charts-event-worker type: application -version: 1.7.0 +version: 1.6.0 dependencies: - name: charts-core - version: 2.9.0 + version: 2.7.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/event-worker/values.yaml b/charts/event-worker/values.yaml index 949926b..26173dd 100644 --- a/charts/event-worker/values.yaml +++ b/charts/event-worker/values.yaml @@ -66,6 +66,7 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: false + redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/job/Chart.yaml b/charts/job/Chart.yaml index 930d1ad..23ba57f 100644 --- a/charts/job/Chart.yaml +++ b/charts/job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Job name: charts-job type: application -version: 2.10.0 +version: 2.9.2 dependencies: - name: charts-core - version: 2.9.0 + version: 2.4.2 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/job/values.yaml b/charts/job/values.yaml index 53dbb89..5e17302 100644 --- a/charts/job/values.yaml +++ b/charts/job/values.yaml @@ -70,6 +70,7 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true + redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true From de04ad2eede2c42bbfab5dcb45314db4e138da96 Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Wed, 9 Sep 2026 15:39:14 +0200 Subject: [PATCH 7/8] . --- charts/app-reverse-proxy/Chart.yaml | 4 ++-- charts/app-reverse-proxy/values.yaml | 1 - charts/cron-job/Chart.yaml | 4 ++-- charts/cron-job/values.yaml | 1 - charts/event-worker/Chart.yaml | 2 +- charts/event-worker/values.yaml | 1 - charts/job/Chart.yaml | 4 ++-- charts/job/values.yaml | 1 - 8 files changed, 7 insertions(+), 11 deletions(-) diff --git a/charts/app-reverse-proxy/Chart.yaml b/charts/app-reverse-proxy/Chart.yaml index acbf924..a255372 100644 --- a/charts/app-reverse-proxy/Chart.yaml +++ b/charts/app-reverse-proxy/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: charts-app-reverse-proxy description: EcoVadis Helm chart for application exposed with nginx reverse proxy type: application -version: 3.1.1 +version: 3.2.0 appVersion: 1.16.0 dependencies: - name: charts-core - version: 2.6.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" diff --git a/charts/app-reverse-proxy/values.yaml b/charts/app-reverse-proxy/values.yaml index 78ff3f1..0bd5620 100644 --- a/charts/app-reverse-proxy/values.yaml +++ b/charts/app-reverse-proxy/values.yaml @@ -107,7 +107,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/cron-job/Chart.yaml b/charts/cron-job/Chart.yaml index 722b839..fa03d92 100644 --- a/charts/cron-job/Chart.yaml +++ b/charts/cron-job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Cron Job name: charts-cron-job type: application -version: 2.11.1 +version: 2.12.0 dependencies: - name: charts-core - version: 2.4.2 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/cron-job/values.yaml b/charts/cron-job/values.yaml index 84262ec..c441548 100644 --- a/charts/cron-job/values.yaml +++ b/charts/cron-job/values.yaml @@ -103,7 +103,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/event-worker/Chart.yaml b/charts/event-worker/Chart.yaml index 3140a6c..874c86e 100644 --- a/charts/event-worker/Chart.yaml +++ b/charts/event-worker/Chart.yaml @@ -5,5 +5,5 @@ type: application version: 1.7.1 dependencies: - name: charts-core - version: 2.7.0 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/event-worker/values.yaml b/charts/event-worker/values.yaml index 07038e6..f62ee94 100644 --- a/charts/event-worker/values.yaml +++ b/charts/event-worker/values.yaml @@ -66,7 +66,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: false - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true diff --git a/charts/job/Chart.yaml b/charts/job/Chart.yaml index 23ba57f..930d1ad 100644 --- a/charts/job/Chart.yaml +++ b/charts/job/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Job name: charts-job type: application -version: 2.9.2 +version: 2.10.0 dependencies: - name: charts-core - version: 2.4.2 + version: 2.9.0 repository: "https://ecovadiscode.github.io/charts/" \ No newline at end of file diff --git a/charts/job/values.yaml b/charts/job/values.yaml index 5e17302..53dbb89 100644 --- a/charts/job/values.yaml +++ b/charts/job/values.yaml @@ -70,7 +70,6 @@ global: eventHubNetworkPolicyEnabled: false lnmElasticNetworkPolicyEnabled: false redisNetworkPolicyEnabled: true - redisCidr: "#{redisCidr}#" sqlNetworkPolicyEnabled: true servicebusNetworkPolicyEnabled: true From cf31cefc792ccba235d73e0339aedb0ba2bd3780 Mon Sep 17 00:00:00 2001 From: Michal Skwierczynski Date: Wed, 9 Sep 2026 15:40:46 +0200 Subject: [PATCH 8/8] fix event worker chart ver --- charts/event-worker/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/event-worker/Chart.yaml b/charts/event-worker/Chart.yaml index 874c86e..6a14004 100644 --- a/charts/event-worker/Chart.yaml +++ b/charts/event-worker/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 description: EcoVadis Helm chart for K8s Event driven Deployment name: charts-event-worker type: application -version: 1.7.1 +version: 1.8.0 dependencies: - name: charts-core version: 2.9.0