Skip to content

chore: add additionalNetworkAllow to keycloak and loki#1379

Merged
mjnagel merged 4 commits intomainfrom
network-allow-flexibility
Mar 24, 2025
Merged

chore: add additionalNetworkAllow to keycloak and loki#1379
mjnagel merged 4 commits intomainfrom
network-allow-flexibility

Conversation

@mjnagel
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel commented Mar 24, 2025

Description

This PR exposes additionalNetworkAllow for Keycloak and Loki:

  • Keycloak: IdP connections can sometimes require egress. While other network policies may cover this (i.e. the postgres/db policy), it's better for all policies to be more restrictive and finegrained.
  • Loki: Loki supports external caching. While we may want to build this into the package itself at some point, for now this value would allow this and any other "conditional features" to be utilized.

These changes are especially helpful as we look towards Istio ambient and only allowing a single Package CR per namespace. This will ensure that any and all network policies are created in this interface (securely) and not via bolt-on netpols.

Related Issue

N/A

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Steps to Validate

Review new chart values/alignment, validate with helm template if desired.

Checklist before merging

@mjnagel mjnagel self-assigned this Mar 24, 2025
@mjnagel mjnagel requested a review from a team as a code owner March 24, 2025 14:38
@mjnagel mjnagel merged commit 8200bce into main Mar 24, 2025
25 checks passed
@mjnagel mjnagel deleted the network-allow-flexibility branch March 24, 2025 15:14
@github-actions github-actions Bot mentioned this pull request Mar 24, 2025
Merged
chance-coleman pushed a commit that referenced this pull request Apr 1, 2025
@github-actions
chore(main): release 0.39.0 (#1373)
0fa1587 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
noahpb pushed a commit that referenced this pull request Apr 2, 2025
@github-actions @noahpb
chore(main): release 0.39.0 (#1373)
66af94c 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel added a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@mjnagel
chore: add additionalNetworkAllow to keycloak and loki (defenseunicor…
592e66f 
…ns#1379)

## Description

This PR exposes `additionalNetworkAllow` for Keycloak and Loki:
- Keycloak: IdP connections can sometimes require egress. While other
network policies may cover this (i.e. the postgres/db policy), it's
better for all policies to be more restrictive and finegrained.
- Loki: Loki supports external caching. While we may want to build this
into the package itself at some point, for now this value would allow
this and any other "conditional features" to be utilized.

These changes are especially helpful as we look towards Istio ambient
and only allowing a single `Package` CR per namespace. This will ensure
that any and all network policies are created in this interface
(securely) and not via bolt-on netpols.

## Related Issue

N/A

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Other (security config, docs update, etc)

## Steps to Validate

Review new chart values/alignment, validate with `helm template` if
desired.

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.39.0 (defenseunicorns#1373)
536fb97 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](defenseunicorns/uds-core@v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([defenseunicorns#1374](defenseunicorns#1374))
([818a3a0](defenseunicorns@818a3a0))
* ambient mesh authorization policy generation
(defenseunicorns#1384)
([b47daba](defenseunicorns@b47daba))
* new webauth and mfa flows
([defenseunicorns#1370](defenseunicorns#1370))
([1ac1b03](defenseunicorns@1ac1b03))
* theme customization
([defenseunicorns#1382](defenseunicorns#1382))
([55ef41b](defenseunicorns@55ef41b))
* use Client Credentials for managing Keycloak Clients
([defenseunicorns#1341](defenseunicorns#1341))
([4db9cc7](defenseunicorns@4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([defenseunicorns#1398](defenseunicorns#1398))
([d45b3e6](defenseunicorns@d45b3e6))
* broken selectors for internal dependencies on charts
([defenseunicorns#1403](defenseunicorns#1403))
([d72b194](defenseunicorns@d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([defenseunicorns#1379](defenseunicorns#1379))
([8200bce](defenseunicorns@8200bce))
* add docs for layer selection
([defenseunicorns#1216](defenseunicorns#1216))
([c170322](defenseunicorns@c170322))
* **deps:** update grafana
([defenseunicorns#1383](defenseunicorns#1383))
([122dc58](defenseunicorns@122dc58))
* **deps:** update grafana to v8.10.4
([defenseunicorns#1363](defenseunicorns#1363))
([fb163bd](defenseunicorns@fb163bd))
* **deps:** update istio to v1.25.0
([defenseunicorns#1335](defenseunicorns#1335))
([1803ea7](defenseunicorns@1803ea7))
* **deps:** update keycloak to v0.11.1
([defenseunicorns#1400](defenseunicorns#1400))
([6fdcd0c](defenseunicorns@6fdcd0c))
* **deps:** update keycloak to v26.1.4
([defenseunicorns#1356](defenseunicorns#1356))
([31152f7](defenseunicorns@31152f7))
* **deps:** update pepr to v0.46.3
([defenseunicorns#1365](defenseunicorns#1365))
([304a556](defenseunicorns@304a556))
* **deps:** update prometheus-stack
([defenseunicorns#1362](defenseunicorns#1362))
([ae40b27](defenseunicorns@ae40b27))
* **deps:** update prometheus-stack
([defenseunicorns#1380](defenseunicorns#1380))
([eec3337](defenseunicorns@eec3337))
* **deps:** update support dependencies to v22.13.17
([defenseunicorns#1401](defenseunicorns#1401))
([8a81eec](defenseunicorns@8a81eec))
* **deps:** update support-deps
([defenseunicorns#1364](defenseunicorns#1364))
([7819bec](defenseunicorns@7819bec))
* **deps:** update support-deps
([defenseunicorns#1376](defenseunicorns#1376))
([dd22589](defenseunicorns@dd22589))
* **deps:** update support-deps
([defenseunicorns#1390](defenseunicorns#1390))
([f06bb70](defenseunicorns@f06bb70))
* **deps:** update support-deps
([defenseunicorns#1392](defenseunicorns#1392))
([c0762a3](defenseunicorns@c0762a3))
* **deps:** update ts-jest to v29.3.0
([defenseunicorns#1377](defenseunicorns#1377))
([8b2174a](defenseunicorns@8b2174a))
* **deps:** update velero to v8.6.0
([defenseunicorns#1371](defenseunicorns#1371))
([93a44e6](defenseunicorns@93a44e6))
* remove kiali and tempo references from repo
([defenseunicorns#1375](defenseunicorns#1375))
([8374de3](defenseunicorns@8374de3))
* update how to scrape metrics
([defenseunicorns#1378](defenseunicorns#1378))
([e808f7d](defenseunicorns@e808f7d))
* update unicorn ztunnel image to 1.25.0
([defenseunicorns#1389](defenseunicorns#1389))
([7e446cb](defenseunicorns@7e446cb))


### Documentation

* velero csi vsphere backups
([defenseunicorns#1385](defenseunicorns#1385))
([5ae33b2](defenseunicorns@5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@noahpb noahpb noahpb approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@mjnagel mjnagel

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mjnagel @noahpb