feat(netpols): ship the cert-manager-webhook-linode allow-rule

charts/apl-network-policies/templates/networkpolicies/cert-manager-webhook-linode.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.netpols.certManagerWebhookLinode }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: cert-manager-webhook-linode-policy
+  namespace: cert-manager
+  labels:
+    {{- include "apl-network-policies.labels" . | nindent 4 }}
+    app: cert-manager-webhook-linode
+spec:
+  # This webhook is deployed by the cert-manager-webhook-linode chart, which labels its pods
+  # `app: cert-manager-webhook-linode` with no `app.kubernetes.io/name`. The cert-manager chart's
+  # own webhook policy selects `app.kubernetes.io/name: webhook`, so it does not — and should not —
+  # cover this one.
+  podSelector:
+    matchLabels:
+      app: cert-manager-webhook-linode
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow the apiserver's discovery probe to reach the aggregated APIService
+    # (v1alpha1.acme.slicen.me). The apiserver is off the pod network on a managed control plane and
+    # has no address a namespaceSelector or ipBlock can pin down, so this rule is scoped by port
+    # rather than by source. Without it the APIService stays Available=False with
+    # FailedDiscoveryCheck and convergence hangs waiting on a certificate that can never be issued.
+    - ports:
+        - protocol: TCP
+          port: 443
+{{- end }}

charts/apl-network-policies/values.yaml

@@ -32,5 +32,14 @@
 #   * Monitoring namespace (for metrics scraping)
 #   * Internal otomi namespace communication
 #
+# For cert-manager-webhook-linode (netpols.certManagerWebhookLinode: true):
+# - Creates a NetworkPolicy in the cert-manager namespace, scoped to the linode DNS-01 solver
+#   webhook pods (labelled `app: cert-manager-webhook-linode`, which the cert-manager chart's own
+#   webhook policy does not select)
+# - Allows ingress from:
+#   * anywhere on 443 — the apiserver's discovery probe for the aggregated APIService, which has
+#     no address a selector or ipBlock can pin down on a managed control plane
+# - Only rendered when linode is the configured DNS provider
+#
 # The complex network policy rules are baked into the chart templates,
 # so users only need to toggle network policies on/off per application.

helmfile.d/snippets/defaults.yaml

@@ -89,6 +89,8 @@ environments:
             _rawValues: {}
           cert-manager:
             issuer: custom-ca
+            networkPolicies:
+              enabled: false
             resources:
               certManager:
                 requests:

values-schema.yaml

@@ -1552,6 +1552,8 @@ properties:
         properties:
           _rawValues:
             $ref: '#/definitions/rawValues'
+          networkPolicies:
+            $ref: '#/definitions/appNetworkPolicyConfig'
           resources:
             certManager:
               $ref: '#/definitions/resources'

values/apl-network-policies/apl-network-policies.gotmpl

@@ -1,12 +1,16 @@
 {{- $v := .Values }}
 {{- $a := $v.apps }}
 {{- $oa := $v.apps | get "otomi-api" }}
+{{- $cm := $v.apps | get "cert-manager" }}
+{{- $dnsProvider := $v | get "dns.provider" dict }}
 
 # Simple per-app network policy configuration
 netpols:
   gitServer: {{ not ($a | get "git-server.enabled") }}
   gitea: {{ $a.gitea.networkPolicies.enabled}}
   otomiApi: {{ $oa.networkPolicies.enabled}}
+  # The linode DNS-01 solver webhook only exists when linode is the DNS provider.
+  certManagerWebhookLinode: {{ and ($cm.networkPolicies.enabled) (hasKey $dnsProvider "linode") }}
 
 ingressGatewaySelectors:
   - namespaceSelector: