remove externalInterfaces + add RBAC and networkPolicy support (#882)

* remove externalInterfaces + add RBAC and networkPolicy support

* mistaken double end

* cleanup values a bit

* fix a small mistake

* That was the wrong mistake

charts/library/common/templates/_HorizontalPodAutoscaler.tpl

@@ -2,7 +2,7 @@
 This template serves as a blueprint for horizontal pod autoscaler objects that are created
 using the common library.
 */}}
-{{- define "common.classes.hpa" -}}
+{{- define "common.hpa" -}}
   {{- if .Values.autoscaling.enabled -}}
     {{- $hpaName := include "common.names.fullname" . -}}
     {{- $targetName := include "common.names.fullname" . }}

charts/library/common/templates/_all.tpl

@@ -24,7 +24,9 @@ Main entrypoint for the common library chart. It will render all underlying temp
     {{- end -}}
  {{- end -}}
 
-  {{ include "common.classes.hpa" . | nindent 0 }}
+  {{ include "common.rbac" . | nindent 0 }}
+
+  {{ include "common.hpa" . | nindent 0 }}
 
   {{ include "common.service" . | nindent 0 }}
 
@@ -33,9 +35,11 @@ Main entrypoint for the common library chart. It will render all underlying temp
   {{- if .Values.secret -}}
     {{ include "common.secret" .  | nindent 0 }}
   {{- end -}}
-  {{ include "common.class.portal" .  | nindent 0 }}
 
-  {{ include "common.class.mountPermissions" .  | nindent 0 }}
-  {{ include "common.classes.externalInterfaces" .  | nindent 0 }}
+  {{ include "common.configmap.portal" .  | nindent 0 }}
+
+  {{ include "common.job.mountPermissions" .  | nindent 0 }}
+
+  {{ include "common.networkpolicy" . | nindent 0 }}
 
 {{- end -}}

charts/library/common/templates/_networkPolicy.tpl

@@ -0,0 +1,38 @@
+{{/*
+Blueprint for the NetworkPolicy object that can be included in the addon.
+*/}}
+{{- define "common.networkpolicy" -}}
+{{- if .Values.networkPolicy.enabled }}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ include "common.names.fullname" . }}
+spec:
+  podSelector:
+  {{- if .Values.networkPolicy.podSelector }}
+  {{- with .Values.networkPolicy.podSelector }}
+    {{- . | toYaml | nindent 4 }}
+  {{- end -}}
+  {{- else }}
+    matchLabels:
+    {{- include "common.labels.selectorLabels" . | nindent 6 }}
+  {{- end }}
+
+  {{- with .Values.networkPolicy.policyTypes }}
+  policyTypes:
+    {{- . | toYaml | nindent 4 }}
+  {{- end -}}
+
+  {{- with .Values.networkPolicy.egress }}
+  egress:
+    {{- . | toYaml | nindent 4 }}
+  {{- end -}}
+
+  {{- with .Values.networkPolicy.ingress }}
+  ingress:
+    {{- . | toYaml | nindent 4 }}
+  {{- end -}}
+
+{{- end -}}
+{{- end -}}

charts/library/common/templates/_rbac.tpl

@@ -0,0 +1,51 @@
+{{/*
+This template serves as a blueprint for all PersistentVolumeClaim objects that are created
+within the common library.
+*/}}
+{{- define "common.rbac" -}}
+{{- if .Values.rbac.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "common.names.fullname" . -}}
+  labels:
+    {{- with .Values.rbac.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- with .Values.rbac.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- with .Values.rbac.rules }}
+rules:
+  {{- . | toYaml | nindent 4 }}
+{{- end -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "common.names.fullname" . -}}
+  labels:
+    {{- with .Values.rbac.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    {{- with .Values.rbac.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "common.names.fullname" . -}}
+subjects:
+  {{- if .Values.serviceAccount }}
+  - kind: ServiceAccount
+    name: {{ include "common.names.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+  {{- end }}
+  {{- with .Values.rbac.subjects }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end }}
+{{- end -}}

charts/library/common/templates/classes/_externalInterfaces.tpl

@@ -1,15 +0,0 @@
-{{/*
-This template serves as a blueprint for External Interface objects that are created
-using the SCALE GUI.
-*/}}
-{{- define "common.classes.externalInterfaces" -}}
-{{- range $index, $iface := .Values.ixExternalInterfacesConfiguration  }}
----
-apiVersion: "k8s.cni.cncf.io/v1"
-kind: NetworkAttachmentDefinition
-metadata:
-  name: ix-{{ $.Release.Name }}-{{ $index }}
-spec:
-  config: '{{ $iface }}'
-{{- end }}
-{{- end -}}

charts/library/common/templates/configmaps/_portal.tpl

@@ -1,4 +1,4 @@
-{{- define "common.class.portal" -}}
+{{- define "common.configmap.portal" -}}
 
 {{- if .Values.portal }}
 {{- if .Values.portal.enabled }}

charts/library/common/templates/jobs/_mountPermissions.tpl

@@ -2,7 +2,7 @@
 This template serves as the blueprint for the mountPermissions job that is run
 before chart installation.
 */}}
-{{- define "common.class.mountPermissions" -}}
+{{- define "common.job.mountPermissions" -}}
   {{- if .Values.persistence -}}
     {{- $jobName := include "common.names.fullname" . -}}
     {{- $group := 568 -}}