rubenhensen/k8scd
1
0 Fork 0
mirror of https://github.com/rubenhensen/k8scd.git synced 2026-11-15 14:29:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Limit the other public apps to their own pods, DNS and the internet

Browse Source
This commit is contained in:
Ruben Hensen committed 2026-10-25 03:21:53 +01:00
1 parent 684f536f2f
commit 67dc4f0783
9 files changed
+419
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

actual-budget/networkpolicy.yaml
+57
View File
@@ -0,0 +1,57 @@
# Actual faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# The OIDC login goes through authentik's public address.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 5006
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
bolletjestrui/networkpolicy.yaml
+56
View File
@@ -0,0 +1,56 @@
# Bolletjestrui faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 3000
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
freshrss/networkpolicy.yaml
+58
View File
@@ -0,0 +1,58 @@
# FreshRSS faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# Feeds and the OIDC login (authentik's public address) go out over
# the internet.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 80
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
gatus/kustomization.yaml
+1
View File
@@ -10,6 +10,7 @@ resources:
- gatus-service.yaml
- certificate.yaml
- httproute.yaml
- networkpolicy.yaml
configMapGenerator:
- name: gatus-config
gatus/networkpolicy.yaml
+66
View File
@@ -0,0 +1,66 @@
# Gatus faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# Its checks go to public addresses; alerts go to ntfy in-cluster.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 8080
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: ntfy
podSelector:
matchLabels:
app: ntfy
ports:
- port: 80
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
gitea/networkpolicy.yaml
+57
View File
@@ -0,0 +1,57 @@
# Gitea faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# Mirrors and webhooks go out over the internet.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 3000
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
ntfy/kustomization.yaml
+1
View File
@@ -10,3 +10,4 @@ resources:
- ntfy-service.yaml
- certificate.yaml
- httproute.yaml
- networkpolicy.yaml
ntfy/networkpolicy.yaml
+67
View File
@@ -0,0 +1,67 @@
# ntfy faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces.
# Push notifications go out over the internet.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 80
# Gatus sends its alerts to ntfy in-cluster.
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: gatus
podSelector:
matchLabels:
app: gatus
ports:
- port: 80
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16
serpbear/networkpolicy.yaml
+56
View File
@@ -0,0 +1,56 @@
# SerpBear faces the internet through Envoy, so its pods only reach each
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
# API or other namespaces. Its scraper APIs are on the internet.
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
# Same layout as mbgwp/networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector: {}
- from:
- ipBlock:
cidr: 192.168.1.204/32
- ipBlock:
cidr: 10.1.7.64/32
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: envoy-gateway-system
podSelector:
matchLabels:
app.kubernetes.io/name: envoy
ports:
- port: 3000
egress:
- to:
- podSelector: {}
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 100.64.0.0/10
- 169.254.0.0/16
- 172.16.0.0/12
- 192.168.0.0/16