Skip to content

[] Add helm/templates/networkpolicy.yaml (DB/Redis/MinIO traffic restriction) and helm/templates/servicemonitor.yaml (Prometheus scraping) #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zoetaka38 merged 2 commits into from
Jun 29, 2026
Merged

[] Add helm/templates/networkpolicy.yaml (DB/Redis/MinIO traffic restriction) and helm/templates/servicemonitor.yaml (Prometheus scraping) #306

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
956e110
chore: Add helm/templates/networkpolicy.yaml (DB/Redis/MinIO traffic …
Jun 28, 2026
4837fc4
Merge remote-tracking branch 'origin/main' into pr306
zoetaka38 Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 73 additions & 0 deletions helm/templates/networkpolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "open-git.fullname" . }}-backend-egress
labels:
{{- include "open-git.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "open-git.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: backend
policyTypes:
- Ingress
- Egress

@orange-codens orange-codens Bot Jun 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [critical] backend-egress ポリシーに ingress ルールが未定義のまま policyTypes: Ingress を宣言している

該当箇所:

  policyTypes:
    - Ingress
    - Egress

policyTypes に Ingress を含めているにもかかわらず、spec.ingress フィールドが一切定義されていません。Kubernetes の NetworkPolicy の仕様では、policyTypes に Ingress を列挙して ingress ルールを省略した場合、その Pod へのすべての ingress トラフィックが拒否 されます（空リスト扱い）。

backend Pod 宛ての受信トラフィック（外部からの HTTP リクエスト、Ingress Controller からの通信など）が全断するため、本番では即座にサービス停止になります。

意図が「egress のみ制限する」なら policyTypes: [Egress] のみにすべきです。もし「ingress も制限したい」なら対応する ingress: ルールを明示的に追加してください。

# 修正案1: egress のみ制御する場合
  policyTypes:
    - Egress

# 修正案2: ingress も制御する場合 (例: Ingress Controller からの 8080 を許可)
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - ports:
        - protocol: TCP
          port: 8080
@@ -13,6 +13,5 @@
   policyTypes:
-    - Ingress
     - Egress

code.kubernetes.networkpolicy_ingress_missing | confidence: 0.97

egress:

@orange-codens orange-codens Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [critical] backend NetworkPolicy が Ingress を全拒否する

policyTypes に Ingress を含めたうえで ingress ルールを定義していないため、Kubernetes NetworkPolicy の仕様上、backend Pod への すべての Ingress トラフィックが拒否 されます。Ingress Controller・Service・liveness/readiness probe 等から backend に到達できなくなり、本番障害につながります。

Task Goal では policyTypes: [Ingress, Egress] が指定されていますが、Ingress ルール未指定のままでは default-deny になります。

該当箇所:

  policyTypes:
    - Ingress
    - Egress
  egress:
@@ -13,4 +13,3 @@
   policyTypes:
-    - Ingress
     - Egress
   egress:

code.networkpolicy.default-deny-ingress | confidence: 0.95

- to:
- podSelector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: {{ .Release.Name }}
ports:
- protocol: TCP
port: 5432
- to:
- podSelector:
matchLabels:
app.kubernetes.io/name: redis
app.kubernetes.io/instance: {{ .Release.Name }}
ports:
- protocol: TCP
port: 6379
- to:
- podSelector:
matchLabels:
app.kubernetes.io/name: minio
app.kubernetes.io/instance: {{ .Release.Name }}
ports:
- protocol: TCP
port: 9000
- ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "open-git.fullname" . }}-postgresql-ingress
labels:
{{- include "open-git.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: {{ .Release.Name }}
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
{{- include "open-git.selectorLabels" . | nindent 14 }}
app.kubernetes.io/component: backend
- podSelector:
matchLabels:
{{- include "open-git.selectorLabels" . | nindent 14 }}
app.kubernetes.io/component: worker
ports:
- protocol: TCP
port: 5432
{{- end }}

@orange-codens orange-codens Bot Jun 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [high] Redis・MinIO の ingress 制限 NetworkPolicy が存在しない

該当箇所:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "open-git.fullname" . }}-postgresql-ingress

タスク要件および PR 説明には「DB/Redis/MinIO traffic restriction」と明記されていますが、実装では PostgreSQL (-postgresql-ingress) の NetworkPolicy のみ作成されており、Redis (6379) および MinIO (9000) への ingress 制限ポリシーが存在しません。

backend からの egress は許可されていますが、Redis/MinIO Pod 側で ingress を制限しないと、他の Pod (攻撃者が掌握した Pod 等) からも直接アクセス可能になります。

Redis・MinIO に対しても同様の ingress ポリシーを追加することを推奨します:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "open-git.fullname" . }}-redis-ingress
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: redis
      app.kubernetes.io/instance: {{ .Release.Name }}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              {{- include "open-git.selectorLabels" . | nindent 14 }}
              app.kubernetes.io/component: backend
      ports:
        - protocol: TCP
          port: 6379

code.kubernetes.networkpolicy_redis_ingress_missing | confidence: 0.92

20 changes: 20 additions & 0 deletions helm/templates/servicemonitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{{- if .Values.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ include "open-git.fullname" . }}-backend
labels:
{{- include "open-git.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
app.kubernetes.io/name: {{ include "open-git.name" . }}
app.kubernetes.io/component: backend
endpoints:
- port: http
path: /metrics
interval: 30s
namespaceSelector:
matchNames:
- {{ .Release.Namespace }}
{{- end }}
Loading