feat(tenant): allow egress to the observability proxy

A tenant's Grafana reads the tenant's logs and metrics through the
observability proxy, and tenant egress is default-deny with one
allow-to-* policy per platform service. The rule is narrowed to the
proxy pods and their port, since the proxy's namespace holds nothing
else a tenant should reach.

Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>

packages/apps/tenant/templates/networkpolicy.yaml

@@ -187,6 +187,23 @@ spec:
 ---
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
+metadata:
+  name: allow-to-observability-proxy
+  namespace: {{ include "tenant.name" . }}
+spec:
+  endpointSelector: {}
+  egress:
+  - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": cozy-observability-proxy
+          app.kubernetes.io/name: observability-proxy
+    toPorts:
+    - ports:
+      - port: "8080"
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
 metadata:
   # Allow the tenant's ingress-nginx to reach both the linstor-gui
   # gatekeeper pods (for /oauth2/* and app traffic) AND the transient

packages/apps/tenant/tests/networkpolicy_observability_proxy_test.yaml

@@ -0,0 +1,61 @@
+suite: tenant egress to the observability proxy
+# A tenant's Grafana reads the tenant's logs and metrics through the
+# observability proxy in cozy-observability-proxy. Tenant egress is
+# default-deny plus explicit allow-to-* policies, so without this one those
+# reads time out. The console reaches the proxy from cozy-dashboard and needs
+# no tenant rule.
+templates:
+  - templates/networkpolicy.yaml
+tests:
+  - it: renders in the root tenant
+    release:
+      name: tenant-root
+      namespace: tenant-root
+    documentSelector:
+      path: metadata.name
+      value: allow-to-observability-proxy
+    asserts:
+      - isKind:
+          of: CiliumNetworkPolicy
+      - equal:
+          path: metadata.namespace
+          value: tenant-root
+
+  - it: renders in a nested tenant with every module off
+    release:
+      name: tenant-bar
+      namespace: tenant-foo
+    set:
+      monitoring: false
+      ingress: false
+      etcd: false
+    documentSelector:
+      path: metadata.name
+      value: allow-to-observability-proxy
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: tenant-foo-bar
+
+  - it: lets every pod of the tenant reach only the proxy pods on their container port
+    release:
+      name: tenant-root
+      namespace: tenant-root
+    documentSelector:
+      path: metadata.name
+      value: allow-to-observability-proxy
+    asserts:
+      - equal:
+          path: spec.endpointSelector
+          value: {}
+      - equal:
+          path: spec.egress
+          value:
+            - toEndpoints:
+                - matchLabels:
+                    "k8s:io.kubernetes.pod.namespace": cozy-observability-proxy
+                    app.kubernetes.io/name: observability-proxy
+              toPorts:
+                - ports:
+                    - port: "8080"
+                      protocol: TCP