networkPolicy customization (#2334)

* networkpolicy customization

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* allow configuring matchLabels, added metrics-port

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* check metricsService.create

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

charts/kyverno/templates/networkpolicy.yaml

@@ -14,7 +14,28 @@ spec:
   - Ingress
   ingress:
   - from:
+      {{- with .Values.networkPolicy }}
+      namespaceSelector:
+        matchExpressions:
+          {{- toYaml .namespaceExpressions | nindent 8 }}
+        matchLabels:
+          {{- range $key, $value := .namespaceLabels }}
+          {{ $key | quote }}: {{ $value | quote }}
+          {{- end }}
+      podSelector:
+        matchExpressions:
+          {{- toYaml .podExpressions | nindent 8 }}
+        matchLabels:
+          {{- range $key, $value := .podLabels }}
+          {{ $key | quote }}: {{ $value | quote }}
+          {{- end }}
+      {{- end }}
     ports:
     - protocol: TCP
       port: 9443 # webhook access
+  # Allow prometheus scrapes for metrics
+  {{- if .Values.metricsService.create }}
+  - ports:
+      - port: {{ .Values.metricsService.port }}
+  {{- end }}
 {{- end }}

charts/kyverno/values.yaml

@@ -218,3 +218,7 @@ createSelfSignedCert: false
 # policies in a default-deny setup.
 networkPolicy:
   enabled: false
+  namespaceExpressions: [{}]
+  namespaceLabels: {}
+  podExpressions: [{}]
+  podLabels: {}