feat: update netpols and swap postgres chart (#74)

## Description
Lock down and add ability to configure network policies. 
Swap dev-postgres chart to operator in line with other packages.

## Related Issue

Fixes #
[67](#67)

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

Release-As: v9.9.2-uds.1

bundle/uds-bundle.yaml

@@ -7,16 +7,33 @@ metadata:
   # x-release-please-end
 
 packages:
-  - name: dev-postgres
-    repository: ghcr.io/defenseunicorns/packages/uds/dev-postgres
-    ref: 0.0.1
-
-  - name: dev-secrets
+  - name: dev-namespace
     path: ../
     ref: 0.1.0
 
+  - name: postgres-operator
+    repository: ghcr.io/defenseunicorns/packages/uds/postgres-operator
+    ref: 1.11.0-uds.0-upstream
+    overrides:
+      postgres-operator:
+        uds-postgres-config:
+          variables:
+            - name: POSTGRESQL
+              description: "Configure postgres using CRs via the uds-postgres-config chart"
+              path: postgresql
+
   - name: sonarqube
     path: ../
     # x-release-please-start-version
     ref: 9.9.2-uds.0
     # x-release-please-end
+    overrides:
+      sonarqube:
+        sonarqube:
+          values:
+            - path: "jdbcOverwrite.jdbcSecretName"
+              value: "sonarqube.sonarqube.pg-cluster.credentials.postgresql.acid.zalan.do"
+            - path: "jdbcOverwrite.jdbcUsername"
+              value: "sonarqube.sonarqube"
+            - path: "jdbcOverwrite.jdbcUrl"
+              value: "jdbc:postgresql://pg-cluster.postgres.svc.cluster.local:5432/sonarqubedb"

bundle/uds-config.yaml

@@ -1,6 +1,15 @@
 variables:
-  dev-postgres:
-    db_username: "sonarqube"
-    db_name: "sonarqubedb"
-  sonarqube:
-    sonarqube_db_endpoint: "postgresql.dev-postgres.svc.cluster.local"
+  postgres-operator:
+    postgresql:
+      enabled: true  # Set to false to not create the PostgreSQL resource
+      teamId: "uds"
+      volume:
+        size: "10Gi"
+      numberOfInstances: 2
+      users:
+        sonarqube.sonarqube: []  # database owner
+      databases:
+        sonarqubedb: sonarqube.sonarqube
+      version: "13"
+      ingress:
+        remoteGenerated: Anywhere

chart/templates/uds-package.yaml

@@ -48,3 +48,48 @@ spec:
         podLabels:
           app: sonarqube
         remoteGenerated: Anywhere
+
+      - direction: Egress
+        remoteNamespace: keycloak
+        remoteSelector:
+          app.kubernetes.io/name: keycloak
+        selector:
+          app: sonarqube
+        port: 8080
+        description: "SSO Internal"
+
+      - direction: Egress
+        remoteGenerated: Anywhere
+        selector:
+          app: sonarqube
+        port: 443
+        description: "SSO External"
+
+      - direction: Egress
+        selector:
+          app: sonarqube
+        {{- if .Values.postgres.internal }}
+        remoteNamespace: {{ .Values.postgres.namespace | quote }}
+        remoteSelector:
+          {{ .Values.postgres.selector | toYaml | nindent 10 }}
+        port: {{ .Values.postgres.port }}
+        {{- else }}
+        remoteGenerated: Anywhere
+        {{- end }}
+        description: "Sonarqube Postgres"
+
+      # Custom rules for unanticipated scenarios
+      {{- range .Values.custom }}
+      - direction: {{ .direction }}
+        selector:
+          {{ .selector | toYaml | nindent 10 }}
+        {{- if not .remoteGenerated }}
+        remoteNamespace: {{ .remoteNamespace }}
+        remoteSelector:
+          {{ .remoteSelector | toYaml | nindent 10 }}
+        port: {{ .port }}
+        {{- else }}
+        remoteGenerated: {{ .remoteGenerated }}
+        {{- end }}
+        description: {{ .description }}
+      {{- end }}

chart/values.yaml

@@ -4,3 +4,25 @@ sso:
   secretName: sonarqube-sso
   saml:
     providerName: Keycloak # This is displayed on the SonarQube landing screen ("Log in with <providerName>")
+postgres:
+  internal: true
+  selector:
+    cluster-name: pg-cluster
+  namespace: postgres
+  port: 5432
+custom: []
+#    # Notice no `remoteGenerated` field here on custom internal rule
+#   - direction: Ingress
+#     selector:
+#       app: jenkins
+#     remoteNamespace: jenkins
+#     remoteSelector:
+#       app: jenkins
+#     port: 8180
+#     description: "Ingress from Jenkins"
+#   # No `remoteNamespace`, `remoteSelector`, or `port` fields on rule to `remoteGenerated`
+#   - direction: Egress
+#     selector:
+#       app: webservice
+#     remoteGenerated: Anywhere
+#     description: "Egress from SonarQube"

src/namespace/ns.yaml

@@ -0,0 +1,4 @@
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: sonarqube

src/namespace/zarf.yaml

@@ -0,0 +1,14 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/defenseunicorns/zarf/main/zarf.schema.json
+kind: ZarfPackageConfig
+metadata:
+  name: dev-namespace
+  description: "create namespaces for cross-ns secret functionality of pg operator"
+  version: 0.1.0
+
+components:
+  - name: deploy-namespace-for-cross-ns-secret
+    required: true
+    manifests:
+      - name: dev-namespace
+        files:
+          - ns.yaml

tasks/dependencies.yaml

@@ -2,4 +2,4 @@ tasks:
   - name: create
     description: Create the Dependency Zarf Package(s)
     actions:
-      - cmd: uds zarf package create src/dev-secrets/ --confirm --no-progress --architecture=${UDS_ARCH} --skip-sbom
+      - cmd: uds zarf package create src/namespace/ --confirm --no-progress --architecture=${UDS_ARCH} --skip-sbom