Most of the rules are very generic and "globally" applied anyway (as they are duplicated into every chart).
We should refactor that into a GlobalNetworkPolicy managed via admin_ng to have it in a central place and to be able to change rules without the need to bump all charts.
While doing so, it might make sense to review things like url-downloader rules as they are only used by a hand full of services.
This now blocks moving new urldownloader hosts into production ( T329945: Migrate the URL downloaders to Bullseye).
Change 893018 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/deployment-charts@master] admin_ng: Add default-network-policy globally
Change 893019 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/deployment-charts@master] Remove default-network-policy-conf
I took the lazy approach to just convert the common default-network-policy-conf.yaml into GlobalNetworkPolicys for wikikube clusters but I do think we should probably remove most if not all of the rules anyways. Do you recall why this common approach was chosen over rules on a per-chart basis @akosiaris ?
It's mostly historical. This predates the Egress support in NetworkPolicy resources and was applied as a patch we developed on the equivalent of calico-kube-controllers (which was a now abandoned python application). When Egress support was added to NetworkPolicy, we opted for following a slow adoption, opt-in approach to avoid breaking charts all across the board (GlobalNetworkPolicy wasn't a thing yet). That's how .Values.networkpolicy.egress.enabled was born and setting it to true would effectively do the following
egress: {{- include "wmf.networkpolicy.egress" .Values }} {{- include "wmf.networkpolicy.egress" (.Files.Get "default-network-policy-conf.yaml" | fromYaml) }}
Charts were including it, adding it to whatever local rules they have.
I am not sure we can just remove all rules. I am betting some access to RESTBase and urldownloaders is based on those rules and not per chart.
Thanks for the insights. Let's add the GlobalNetworkPolicy then as proposed.
I'll open a separate task where we can discuss options to remove network constants and IPs (form outside K8s) from charts altogether as this becomes more and more a pain.
Change 893018 merged by jenkins-bot:
[operations/deployment-charts@master] admin_ng: Add default-network-policy globally
Change 893019 merged by jenkins-bot:
[operations/deployment-charts@master] Remove default-network-policy-conf
I've depoyed the following services after updating their charts removing default-network-policy in staging:
Mediawiki services are affected as well, but not deployed to staging: