Add per-service NetworkPolicies covering every Fission listener

[sanketsudake]

Summary

Extends NetworkPolicy coverage from storagesvc-only to every Fission service that exposes a non-metrics listener. When networkPolicy.enabled=true (default false, backwards-compat-preserving), six policies render:

Policy	Pod selector	Ingress allowed
router-allow-ingress	svc=router, application=fission-router	8888 from any (LB/Ingress); 8888 from internal publishers (kubewatcher, timer, mqtrigger, mqtrigger-keda, canaryconfig); 8080 from any
executor-allow-internal	svc=executor	8888 from application=fission-router only; 8080 from any
storagesvc-allow-internal	svc=storagesvc, application=fission-storage	8000 from owner=buildermgr and executorType ∈ {poolmgr,newdeploy,container}; 8080 from any (relocated, rules unchanged)
webhook-server-allow-apiserver	svc=webhook-service, application=fission-webhook	9443 (kube-apiserver, unselectable by podSelector); 8080 from any
builderpods-allow-buildermgr	owner=buildermgr	8000 fetcher + 8001 builder, both from svc=buildermgr
functionpods-allow-internal	executorType ∈ {poolmgr,newdeploy,container}	8000 from svc=executor (specialize); 8888 from application=fission-router (function invocation)

Each policy lives next to the service folder it protects. Controller-created pods (env-builder, function pods) get their policy under the controlling service's folder for discoverability. All policies are ingress-only, gated on the existing global networkPolicy.enabled flag, and pair every podSelector with namespaceSelector: {} so user-namespace pods can still reach Fission install-namespace services. Reuses labels already produced by the chart and controllers (svc, application, owner, executorType) — no Deployment template changes.

Closes the .security-fixes/findings-index promise that the IDOR cluster and http-no-ssl finding are mitigated by NetworkPolicy in lieu of the deferred RFC 0001 application-layer auth.

Test plan

• helm lint charts/fission-all --set networkPolicy.enabled=true → 0 chart(s) failed
• helm template ... --set networkPolicy.enabled=false → renders 0 NetworkPolicy resources
• helm template ... --set networkPolicy.enabled=true → renders exactly 6 NetworkPolicy resources, all parse cleanly with expected ingress-rule counts
• CI integration tests on the kind-ci skaffold profile (which already sets networkPolicy.enabled=true via a replace patch) pass — any selector regression surfaces here
• Manual: invoke an HTTP-triggered function on a kind cluster with the flag enabled, verify build + invoke succeed end-to-end

Out of scope (deferred)

• Egress NetworkPolicies — would need DNS / API-server / external-MQ allowlists; tracked as a follow-up
• Default-deny baseline in the install namespace
• Metrics-only services (buildermgr, kubewatcher, timer, mqtrigger, mqtrigger-keda, canaryconfig) — only listener is the metrics port, public-by-design
• pprof port (6060) ingress — runtime debug flag; operators who turn it on accept the surface
• RFC 0001 HMAC application-layer auth — separate workstream

🤖 Generated with Claude Code

---

This change is 

[Copilot]

Pull request overview

Adds Helm-rendered, ingress-only Kubernetes NetworkPolicies to the charts/fission-all chart to better document and restrict network reachability of Fission control-plane listeners when networkPolicy.enabled=true.

Changes:

• Expands NetworkPolicy templates from storagesvc-only coverage to multiple Fission services (router, executor, webhook, plus controller-managed pods).
• Updates values.yaml documentation to describe the new policy set and its intent/limitations (ingress-only; metrics left open).
• Introduces new per-service NetworkPolicy template files colocated with the services they protect.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
charts/fission-all/values.yaml	Updates chart docs for the new NetworkPolicy feature set and behavior.
charts/fission-all/templates/webhook-server/networkpolicy.yaml	Adds a webhook NetworkPolicy allowing ports 9443 and 8080 (comment currently overstates source restriction).
charts/fission-all/templates/storagesvc/networkpolicy.yaml	Adds storagesvc ingress restrictions for archive API (8000) while leaving metrics (8080) open.
charts/fission-all/templates/router/networkpolicy.yaml	Adds router ingress policy documenting/allowing router HTTP + metrics ports.
charts/fission-all/templates/executor/networkpolicy.yaml	Adds executor ingress policy restricting executor API to router (but currently over-broad via namespaceSelector).
charts/fission-all/templates/executor/networkpolicy-functionpods.yaml	Adds function-pod ingress policy for specialize/invoke ports (currently rendered into the wrong namespace).
charts/fission-all/templates/buildermgr/networkpolicy-builderpods.yaml	Adds env-builder-pod ingress policy for fetch/build ports (currently rendered into the wrong namespace).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sanketsudake]

Fixed in 7d3cdd8. Rendered the policy into fission-builder-ns (builderNamespace || defaultNamespace) via the existing include helper, so it now actually selects owner=buildermgr pods. Verified rendered namespace via helm template for both default install (→ default) and the kind-ci layout (→ fission-builder). Source selector keeps namespaceSelector: {} because buildermgr itself runs in the release namespace, so the source needs to be cross-namespace.

[sanketsudake]

Fixed in 7d3cdd8. Same root cause — relocated the policy into fission-function-ns (functionNamespace || defaultNamespace) so the executorType selector matches the actual function pods. Both source rules (executor on 8000, router on 8888) keep namespaceSelector: {} because both controllers run in the release namespace.

[sanketsudake]

Fixed in 7d3cdd8. Reworded the header comment to be honest about what the policy enforces — only that no listener other than 9443 and 8080 is reachable on webhook-server pods (NetworkPolicy default-deny semantics for selected pods). The 9443 source remains unrestricted because the kube-apiserver isn't selectable by podSelector on most clusters.

[sanketsudake]

Fixed in 7d3cdd8. Dropped namespaceSelector: {} on the router source rule so it's scoped to the policy namespace (release ns). Both router and executor live in the release namespace, so this tightens the rule without affecting normal routing. Other policies that legitimately need cross-namespace sources (storagesvc, builderpods, functionpods) still keep the wildcard because the controllers and target pods are in different namespaces.