Merge branch 'release/v1.3.0' into main

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v1.3.0] - 2024-12-05
+### Added
+- [#40] Add NetworkPolicy to deny all ingress traffic
+
 ## [v1.2.0] - 2024-11-29
 ### Changed
 - [#37] Refactor rbac permissions to be more clear and better match the use cases

Dockerfile

@@ -34,7 +34,7 @@ RUN make compile-generic
 FROM gcr.io/distroless/static:nonroot
 LABEL maintainer="[email protected]" \
       NAME="k8s-backup-operator" \
-      VERSION="1.2.0"
+      VERSION="1.3.0"
 
 WORKDIR /
 COPY --from=builder /workspace/target/k8s-backup-operator .

Makefile

@@ -1,6 +1,6 @@
 # Set these to the desired values
 ARTIFACT_ID=k8s-backup-operator
-VERSION=1.2.0
+VERSION=1.3.0
 IMAGE=cloudogu/${ARTIFACT_ID}:${VERSION}
 GOTAG?=1.23
 LINT_VERSION=v1.61.0

k8s/helm/component-patch-tpl.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 values:
   images:
-    backupOperator: cloudogu/k8s-backup-operator:1.2.0
+    backupOperator: cloudogu/k8s-backup-operator:1.3.0
     kubeRbacProxy: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
 patches:
   values.yaml:

k8s/helm/templates/network-policy-deny-all.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.global.networkPolicies.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backup-operator-deny-ingress
+  namespace: {{ .Release.Namespace }}
+  labels:
+      {{- include "k8s-backup-operator.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: k8s-backup-operator
+  policyTypes:
+    - Ingress
+{{- end }}

k8s/helm/values.yaml

@@ -1,6 +1,8 @@
 global:
   imagePullSecrets:
     - name: "ces-container-registries"
+  networkPolicies:
+    enabled: true
 retention:
   strategy: keepAll
   garbageCollectionCron: "0 * * * *"
@@ -23,7 +25,7 @@ manager:
   image:
     registry: docker.io
     repository: cloudogu/k8s-backup-operator
-    tag: 1.2.0
+    tag: 1.3.0
   imagePullPolicy: IfNotPresent
   resources:
     limits: