Adapt NetworkPolicys according to recent refactorings (#581)

* Revendor gardener/gardener@1.66

* Pass webhook server namespace to ControlPlane controller

* Allow extension to talk to its runtime cluster

* Allow extension to talk to all shoot kube-apiservers

This is needed for the health check of the `Worker` resource.

* Allow extension to reach out to provider-specific APIs

* Allow access to extension webhook port from world

* Allow extension to be scraped from `seed-prometheus`

* [make generate]

* Adapt `to-shoot-apiserver` policy

* Adapt `to-runtime` policy

* Adapt `from-shoot-apiserver` policy

* Adapt `from-prometheus`  policy

charts/gardener-extension-provider-alicloud/templates/deployment.yaml

@@ -34,6 +34,11 @@ spec:
         prometheus.io/port: "{{ .Values.metricsPort }}"
         {{- end }}
       labels:
+        networking.gardener.cloud/to-runtime-apiserver: allowed
+        networking.gardener.cloud/to-dns: allowed
+        networking.gardener.cloud/to-public-networks: allowed
+        networking.gardener.cloud/to-private-networks: allowed
+        networking.resources.gardener.cloud/to-all-shoots-kube-apiserver-tcp-443: allowed
 {{ include "labels" . | indent 8 }}
     spec:
       priorityClassName: gardener-system-900

charts/gardener-extension-provider-alicloud/templates/service.yaml

@@ -3,8 +3,13 @@ kind: Service
 metadata:
   name: {{ include "name" . }}
   namespace: {{ .Release.Namespace }}
-{{-  if .Values.ignoreResources }}
   annotations:
+    networking.resources.gardener.cloud/from-world-to-ports: '[{"protocol":"TCP","port":{{ .Values.webhookConfig.serverPort }}}]'
+    networking.resources.gardener.cloud/from-policy-pod-label-selector: all-seed-scrape-targets
+    networking.resources.gardener.cloud/from-policy-allowed-ports: '[{"port":{{ .Values.metricsPort }},"protocol":"TCP"}]'
+    networking.resources.gardener.cloud/namespace-selectors: '[{"matchLabels":{"kubernetes.io/metadata.name":"garden"}}]'
+    networking.resources.gardener.cloud/pod-label-selector-namespace-alias: extensions
+{{- if .Values.ignoreResources }}
     resources.gardener.cloud/ignore: "true"
 {{- end }}
   labels:

charts/internal/machine-controller-manager/seed/templates/deployment.yaml

@@ -28,9 +28,8 @@ spec:
         networking.gardener.cloud/to-dns: allowed
         networking.gardener.cloud/to-public-networks: allowed
         networking.gardener.cloud/to-private-networks: allowed
-        networking.gardener.cloud/to-seed-apiserver: allowed
-        networking.gardener.cloud/to-shoot-apiserver: allowed
-        networking.gardener.cloud/from-prometheus: allowed
+        networking.gardener.cloud/to-runtime-apiserver: allowed
+        networking.resources.gardener.cloud/to-kube-apiserver-tcp-443: allowed
 {{- if .Values.podLabels }}
 {{ toYaml .Values.podLabels | indent 8 }}
 {{- end }}

charts/internal/machine-controller-manager/seed/templates/service.yaml

@@ -6,6 +6,9 @@ metadata:
   labels:
     app: kubernetes
     role: machine-controller-manager
+  annotations:
+    networking.resources.gardener.cloud/from-policy-pod-label-selector: all-scrape-targets
+    networking.resources.gardener.cloud/from-policy-allowed-ports: '[{"port":{{ .Values.metricsPort }},"protocol":"TCP"}]'
 spec:
   type: ClusterIP
   clusterIP: None

charts/internal/seed-controlplane/charts/alicloud-cloud-controller-manager/templates/alicloud-ccm-service.yaml

@@ -6,6 +6,9 @@ metadata:
   labels:
     app: kubernetes
     role: cloud-controller-manager
+  annotations:
+    networking.resources.gardener.cloud/from-policy-pod-label-selector: all-scrape-targets
+    networking.resources.gardener.cloud/from-policy-allowed-ports: '[{"port":"10258","protocol":"TCP"}]'
 spec:
   type: ClusterIP
   clusterIP: None

charts/internal/seed-controlplane/charts/alicloud-cloud-controller-manager/templates/deployment.yaml

@@ -27,9 +27,8 @@ spec:
         role: cloud-controller-manager
         networking.gardener.cloud/to-dns: allowed
         networking.gardener.cloud/to-public-networks: allowed
-        networking.gardener.cloud/to-shoot-apiserver: allowed
         networking.gardener.cloud/to-alicloud-networks: allowed
-        networking.gardener.cloud/from-prometheus: allowed
+        networking.resources.gardener.cloud/to-kube-apiserver-tcp-443: allowed
 {{- if .Values.podLabels }}
 {{ toYaml .Values.podLabels | indent 8 }}
 {{- end }}

charts/internal/seed-controlplane/charts/csi-alicloud/templates/csi-plugin-controller.yaml

@@ -26,8 +26,8 @@ spec:
         role: csi-plugin-controller
         networking.gardener.cloud/to-dns: allowed
         networking.gardener.cloud/to-public-networks: allowed
-        networking.gardener.cloud/to-shoot-apiserver: allowed
         networking.gardener.cloud/to-alicloud-networks: allowed
+        networking.resources.gardener.cloud/to-kube-apiserver-tcp-443: allowed
     spec:
       automountServiceAccountToken: false
       priorityClassName: gardener-system-300

charts/internal/seed-controlplane/charts/csi-alicloud/templates/csi-snapshot-controller.yaml

@@ -24,7 +24,7 @@ spec:
         app: csi-snapshot-controller
         role: controller
         networking.gardener.cloud/to-dns: allowed
-        networking.gardener.cloud/to-shoot-apiserver: allowed
+        networking.resources.gardener.cloud/to-kube-apiserver-tcp-443: allowed
     spec:
       automountServiceAccountToken: false
       priorityClassName: gardener-system-200

charts/internal/seed-controlplane/charts/csi-alicloud/templates/csi-snapshot-validation-webhook-deployment.yaml

@@ -19,7 +19,6 @@ spec:
 {{- end }}
       labels:
         app: snapshot-validation
-        networking.gardener.cloud/from-shoot-apiserver: allowed
     spec:
       priorityClassName: gardener-system-200
       containers:

cmd/gardener-extension-provider-alicloud/app/app.go

@@ -238,6 +238,7 @@ func NewControllerManagerCommand(ctx context.Context) *cobra.Command {
 				return fmt.Errorf("could not add webhooks to manager: %w", err)
 			}
 			alicloudcontrolplane.DefaultAddOptions.ShootWebhookConfig = atomicShootWebhookConfig
+			alicloudcontrolplane.DefaultAddOptions.WebhookServerNamespace = webhookOptions.Server.Namespace
 
 			if err := controllerSwitches.Completed().AddToManager(mgr); err != nil {
 				return fmt.Errorf("could not add controllers to manager: %w", err)