fix: validating/mutating webhook networkpolicies and mtls

src/metrics-server/chart/templates/peerauthentication/metrics-api.yaml

@@ -11,6 +11,7 @@ spec:
     matchLabels:
       app.kubernetes.io/name: metrics-server
   portLevelMtls:
+    # Allow api service calls to operate permissive since ingress originates from the nodes
     "10250":
       mode: PERMISSIVE
 {{- end }}

src/neuvector/chart/templates/peerauthentication/neuvector-controller-pa.yaml

@@ -13,4 +13,7 @@ spec:
   portLevelMtls:
     "18300":
       mode: PERMISSIVE
-{{- end }}
+    # Allow webhooks to operate permissive since ingress originates from the nodes
+    "30443":
+      mode: PERMISSIVE
+{{- end }}

src/neuvector/chart/templates/uds-package.yaml

@@ -31,6 +31,14 @@ spec:
         selector:
           app: neuvector-updater-pod
 
+      - direction: Ingress
+        # todo: evaluate a "KubeAPI" _ingress_ generated rule for webhook calls
+        remoteGenerated: Anywhere
+        selector:
+          app: neuvector-controller-pod
+        port: 30443
+        description: "Webhook"
+
       - direction: Ingress
         remoteNamespace: monitoring
         remoteSelector:

src/prometheus-stack/chart/templates/peerauthentication/prometheus-operator-pa.yaml

@@ -0,0 +1,17 @@
+{{- if .Capabilities.APIVersions.Has "security.istio.io/v1beta1" }}
+apiVersion: "security.istio.io/v1beta1"
+kind: PeerAuthentication
+metadata:
+  name: prometheus-operator-webhook
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      app: kube-prometheus-stack-operator
+  mtls:
+    mode: STRICT
+  portLevelMtls:
+    # Allow webhooks to operate permissive since ingress originates from the nodes
+    "10250":
+      mode: PERMISSIVE
+{{- end }}

src/prometheus-stack/chart/templates/uds-package.yaml

@@ -33,6 +33,14 @@ spec:
         selector:
           app: kube-prometheus-stack-admission-patch
 
+      - direction: Ingress
+        # todo: evaluate a "KubeAPI" _ingress_ generated rule for webhook calls
+        remoteGenerated: Anywhere
+        selector:
+          app: kube-prometheus-stack-operator
+        port: 10250
+        description: "Webhook"
+
       # todo: lockdown egress to scrape targets
       - direction: Egress
         remoteNamespace: ""