From ee845cdc7802a6fdb269694f3f862ee9b40a9f4c Mon Sep 17 00:00:00 2001 From: Maicon Berlofa Date: Fri, 3 Jul 2026 17:48:19 -0300 Subject: [PATCH 1/2] docs(qdrant): sync template standards updates --- src/data/playground-configs.ts | 28 ++++++++++++++++++++++++++++ src/pages/docs/charts/qdrant.mdx | 19 ++++++++++++++++++- src/pages/playground.astro | 1 + 3 files changed, 47 insertions(+), 1 deletion(-) diff --git a/src/data/playground-configs.ts b/src/data/playground-configs.ts index b7109746..d55e7b82 100644 --- a/src/data/playground-configs.ts +++ b/src/data/playground-configs.ts @@ -8363,6 +8363,34 @@ export const chartConfigs: Record = { }, ], }, + { + name: 'Network Policy', + collapsible: true, + gateField: 'networkPolicy.enabled', + fields: [ + { + label: 'Ingress Namespace', + key: 'networkPolicy.ingressFrom[0].namespaceSelector.matchLabels.kubernetes\\.io/metadata\\.name', + type: 'text', + default: 'rag', + description: 'Namespace allowed to reach Qdrant HTTP and gRPC', + }, + { + label: 'Extra Egress CIDR', + key: 'networkPolicy.extraEgress[0].to[0].ipBlock.cidr', + type: 'text', + default: '10.0.0.0/8', + description: 'Additional destination allowed after baseline DNS, HTTPS, and p2p rules', + }, + { + label: 'Extra Egress Port', + key: 'networkPolicy.extraEgress[0].ports[0].port', + type: 'number', + default: '6333', + description: 'Additional TCP egress port', + }, + ], + }, ], memos: [ { diff --git a/src/pages/docs/charts/qdrant.mdx b/src/pages/docs/charts/qdrant.mdx index 2960eb77..a14a753b 100644 --- a/src/pages/docs/charts/qdrant.mdx +++ b/src/pages/docs/charts/qdrant.mdx @@ -54,6 +54,13 @@ resources: networkPolicy: enabled: true + extraEgress: + - to: + - ipBlock: + cidr: 10.0.0.0/8 + ports: + - protocol: TCP + port: 6333 ``` ## Runtime Values @@ -85,7 +92,8 @@ Security and exposure: - `service.type`, `service.port`, `service.grpcPort`, `service.annotations`, `service.ipFamilyPolicy`, `service.ipFamilies`. - `ingress.enabled`, `ingress.ingressClassName`, `ingress.annotations`, `ingress.hosts`, `ingress.tls`. - `gateway.enabled`, `gateway.parentRefs`, `gateway.hostnames`, `gateway.path`, `gateway.pathType`. -- `networkPolicy.enabled`, `networkPolicy.ingressFrom`: client ingress peers. Cluster p2p traffic gets a separate self-peer rule. +- `networkPolicy.enabled`, `networkPolicy.ingressFrom`, `networkPolicy.extraEgress`: client ingress peers and optional egress isolation. + Cluster p2p traffic gets separate self-peer ingress and egress rules when needed. Operations: @@ -113,6 +121,15 @@ The chart also owns the startup command in distributed mode so it can pass Qdran for additional Qdrant flags. Plan snapshots, restore procedures, and collection replication before enabling this in production. +## Network Policy + +`networkPolicy.enabled=true` restricts inbound HTTP and gRPC traffic to the configured `networkPolicy.ingressFrom` peers, or to all +namespaces when no peers are set. Cluster p2p ingress is allowed from Qdrant pods when `cluster.enabled=true`. + +Setting `networkPolicy.extraEgress` also enables egress isolation. The chart keeps DNS and HTTPS egress available before appending custom +egress rules. In distributed mode, it also keeps Qdrant p2p egress between pods so cluster bootstrap and peer communication remain +available. + ## Monitoring Qdrant exposes Prometheus metrics at `/metrics`. diff --git a/src/pages/playground.astro b/src/pages/playground.astro index 6dabe570..abf734d4 100644 --- a/src/pages/playground.astro +++ b/src/pages/playground.astro @@ -55,6 +55,7 @@ const siteSyncPlaygroundConfigs: Record = { memcached: 'src/data/playground-configs.ts', notediscovery: 'src/data/playground-configs.ts', poznote: 'src/data/playground-configs.ts', + qdrant: 'src/data/playground-configs.ts', }; const configuredChartSlugs = new Set([...Object.keys(mergedConfigs), ...Object.keys(siteSyncPlaygroundConfigs)]); const playgroundCharts = charts.filter( From d9aee39f0cb846f88287503b86a6b46d63b8915a Mon Sep 17 00:00:00 2001 From: Maicon Berlofa Date: Sun, 5 Jul 2026 16:11:23 -0300 Subject: [PATCH 2/2] docs(qdrant): clarify network policy https egress --- src/pages/docs/charts/qdrant.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/pages/docs/charts/qdrant.mdx b/src/pages/docs/charts/qdrant.mdx index a14a753b..dccb21d4 100644 --- a/src/pages/docs/charts/qdrant.mdx +++ b/src/pages/docs/charts/qdrant.mdx @@ -126,9 +126,9 @@ Plan snapshots, restore procedures, and collection replication before enabling t `networkPolicy.enabled=true` restricts inbound HTTP and gRPC traffic to the configured `networkPolicy.ingressFrom` peers, or to all namespaces when no peers are set. Cluster p2p ingress is allowed from Qdrant pods when `cluster.enabled=true`. -Setting `networkPolicy.extraEgress` also enables egress isolation. The chart keeps DNS and HTTPS egress available before appending custom -egress rules. In distributed mode, it also keeps Qdrant p2p egress between pods so cluster bootstrap and peer communication remain -available. +Setting `networkPolicy.extraEgress` also enables egress isolation. The chart keeps DNS and broad HTTPS egress to any IPv4/IPv6 +destination available before appending custom egress rules. In distributed mode, it also keeps Qdrant p2p egress between pods so cluster +bootstrap and peer communication remain available. ## Monitoring