isolate logic (#680)

paritytech · Jan 10, 2023 · 9ea8baf · 9ea8baf
1 parent dfc5465
commit 9ea8baf
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/javascript/packages/orchestrator/src/providers/k8s/kubeClient.ts b/javascript/packages/orchestrator/src/providers/k8s/kubeClient.ts
@@ -89,6 +89,10 @@ export class KubeClient extends Client {
 
     writeLocalJsonFile(this.tmpDir, "namespace", namespaceDef);
     await this.createResource(namespaceDef);
+
+    // ensure namespace isolation IFF we are running in CI
+    if (process.env.RUN_IN_CONTAINER === "1")
+      await this.createStaticResource("namespace-network-policy.yaml");
   }
 
   async spawnFromDef(

diff --git a/javascript/packages/orchestrator/static-configs/namespace-network-policy.yaml b/javascript/packages/orchestrator/static-configs/namespace-network-policy.yaml
@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: internal-access
+spec:
+  podSelector: {}
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+          - {{namespace}}
+          - gitlab
+          - loki
+          - tempo
+          - monitoring
+          - parachain-exporter
+  policyTypes:
+  - Ingress