Fix network policy

[wilsonianb]

Description

Fixes #669 by giving audit-event access to gateway since echo function is the default slack_url.
This would need to be reflected in ofc-bootstrap's stack.yml (as should 2c836f3).

Re-adds support for legacy ingress nginx network policy label (1713d32).

How Has This Been Tested?

Tested on k3s with calico

k3sup install --ip $IP --user $USER --k3s-extra-args "--flannel-backend=none --cluster-cidr=192.168.0.0/16 --no-deploy traefik"
kubectl apply -k github.com/wilsonianb/calico-k3s

Followed ofc-bootstrap user guide (without oauth) with network policies enabled and openfaas_cloud_version set to 0.14.1

Used pre-release ofc-bootstrap v0.9.6 with role: openfaas-system label added to audit-event in templates/stack.yml.

GitHub events no longer time out with this PR change.

Ran helm chart tests with go test in $GO_PATH/src/openfaas-cloud/chart/test/ and ran diff on chart/test/tmp/openfaas-cloud/templates/network-policy/ns-openfaas-net-policy.yml and yaml/network-policy/ns-openfaas-net-policy.yml files.

How are existing users impacted? What migration steps/scripts do we need?

Should only help OpenFaaS Cloud cluster administrators who had network policies previously enabled and re-run ofc-bootstrap.

Checklist:

I have:

• updated the documentation and/or roadmap (if required)
• read the CONTRIBUTION guide
• signed-off my commits with git commit -s
• added unit tests

[alexellis]

Couple of comments

[alexellis]

Why was this removed? Shouldn't it be ingress-nginx now?

[wilsonianb]

I relocated it to edge-router and gateway specific policies since afaict those are the only openfaas pods ingress nginx needs to access.

[alexellis]

Is it possible to keep both for legacy users? ingress-nginx and nginx-ingress?

[wilsonianb]

re-added the old label
95ac2e4

[alexellis]

Please could you raise an issue with the issues you've found?

The Nginx Ingress label name change is here:
1713d32

As I mentioned on Slack, I think it will take me a day away from work to verify this PR, so whatever we can do to make that smoother would go a long way.

[Waterdrips]

LGTM

[alexellis]

@wilsonianb did you get an issue raised? If so please link it back here through adding a comment or editing its description - GitHub will work out the rest.

[alexellis]

Approved

[alexellis]

There was a much bigger PR I remembered, was that not needed? Can you link it here if it is still around?

[wilsonianb]

here's the original changeset
master...wilsonianb:og-net-policy
This ended up being much smaller since:

• I realized metrics already had the openfaas-system role (It just isn't reflected yet in ofc-bootstrap's stack.yml)
• I opted to stick with the openfaas-system role model, instead of adding additional network policy rules (which would help constrain pods to only access exactly what they need, but would likely be harder to maintain)