feat: allow traefik to bucketweb and queryFrontend

camptocamp · Aug 20, 2024 · a98ad02 · a98ad02
1 parent 4a8ac12
commit a98ad02
Show file tree

Hide file tree

Showing 6 changed files with 34 additions and 12 deletions.
diff --git a/aks/main.tf b/aks/main.tf
@@ -71,7 +71,7 @@ module "thanos" {
   enable_service_monitor = var.enable_service_monitor
   app_autosync           = var.app_autosync
   dependency_ids         = var.dependency_ids
-  network_policy_thanos  = var.network_policy_thanos
+  enable_network_policies  = var.enable_network_policies
 
   resources = var.resources
 

diff --git a/eks/main.tf b/eks/main.tf
@@ -62,7 +62,7 @@ module "thanos" {
   enable_service_monitor = var.enable_service_monitor
   app_autosync           = var.app_autosync
   dependency_ids         = var.dependency_ids
-  network_policy_thanos  = var.network_policy_thanos
+  enable_network_policies  = var.enable_network_policies
 
   resources = var.resources
 

diff --git a/kind/main.tf b/kind/main.tf
@@ -13,7 +13,7 @@ module "thanos" {
   enable_service_monitor = var.enable_service_monitor
   app_autosync           = var.app_autosync
   dependency_ids         = var.dependency_ids
-  network_policy_thanos  = var.network_policy_thanos
+  enable_network_policies  = var.enable_network_policies
 
   resources = var.resources
 

diff --git a/locals.tf b/locals.tf
@@ -44,7 +44,7 @@ locals {
           limits   = { for k, v in var.resources.storegateway.limits : k => v if v != null }
         }
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
         }
         extraFlags = [
           # Store Gateway index cache config -> https://thanos.io/tip/components/store.md/#index-cache
@@ -84,7 +84,7 @@ locals {
           limits   = { for k, v in var.resources.query.limits : k => v if v != null }
         }
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
         }
       }
 
@@ -108,7 +108,7 @@ locals {
           size = local.thanos.compactor_persistence_size
         }
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
         }
       }
 
@@ -200,7 +200,18 @@ locals {
           }]
         }
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
+          extraIngress = var.enable_network_policies ? [
+            {
+              from = {
+                namespaceSelector = {
+                  matchLabels = {
+                    "app.kubernetes.io/metadata.name" = "traefik"
+                  }
+                }
+              }
+            }
+          ] : []
         }
       }
 
@@ -334,17 +345,28 @@ locals {
           }]
         }
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
+          extraIngress = var.enable_network_policies ? [
+            {
+              from = {
+                namespaceSelector = {
+                  matchLabels = {
+                    "app.kubernetes.io/metadata.name" = "traefik"
+                  }
+                }
+              }
+            }
+          ] : []
         }
       }
       receive = {
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
         }
       }
       ruler = {
         networkPolicy = {
-          enabled = var.network_policy_thanos
+          enabled = var.enable_network_policies
         }
       }
     }

diff --git a/sks/main.tf b/sks/main.tf
@@ -13,7 +13,7 @@ module "thanos" {
   enable_service_monitor = var.enable_service_monitor
   app_autosync           = var.app_autosync
   dependency_ids         = var.dependency_ids
-  network_policy_thanos  = var.network_policy_thanos
+  enable_network_policies  = var.enable_network_policies
 
   resources = var.resources
 

diff --git a/variables.tf b/variables.tf
@@ -175,7 +175,7 @@ variable "enable_service_monitor" {
   default     = false
 }
 
-variable "network_policy_thanos" {
+variable "enable_network_policies" {
   description = "Enable or disable network policy for Thanos components."
   type        = bool
   default     = false