feat(network-policies): add minio policies

templates/distribution/manifests/logging/policies/minio.yaml.tpl

@@ -104,4 +104,69 @@ spec:
               kubernetes.io/metadata.name: monitoring
           podSelector:
             matchLabels:
-              app.kubernetes.io/name: prometheus
+              app.kubernetes.io/name: prometheus
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-egress-https
+  namespace: logging
+  labels:
+    app: minio
+spec:
+  policyTypes:
+    - Egress
+  podSelector:
+    matchLabels:
+      app: minio
+  egress:
+    - ports:
+      - port: 443
+        protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-ingress-nginxingresscontroller
+  namespace: logging
+  labels:
+    app: minio
+spec:
+  policyTypes:
+    - Ingress
+  podSelector:
+    matchLabels:
+      app: minio
+  ingress:
+# single nginx, no sso
+{{ if and (eq .spec.distribution.modules.ingress.nginx.type "single") (ne .spec.distribution.modules.auth.provider.type "sso") }}
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: ingress-nginx
+        podSelector:
+          matchLabels:
+            app: ingress-nginx
+# dual nginx, no sso
+{{ else if and (eq .spec.distribution.modules.ingress.nginx.type "dual") (ne .spec.distribution.modules.auth.provider.type "sso") }}
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: ingress-nginx
+        podSelector:
+          matchLabels:
+            app: ingress
+# sso
+{{ else if (eq .spec.distribution.modules.auth.provider.type "sso") }}
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: pomerium
+        podSelector:
+          matchLabels:
+            app: pomerium
+{{ end }}
+      ports:
+        - port: 9001
+          protocol: TCP
+---