mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
# Bolletjestrui faces the internet through Envoy, so its pods only reach each
|
|
# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes
|
|
# API or other namespaces.
|
|
# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64
|
|
# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
|
|
# Same layout as mbgwp/networkpolicy.yaml.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 192.168.1.204/32
|
|
- ipBlock:
|
|
cidr: 10.1.7.64/32
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
ports:
|
|
- port: 3000
|
|
egress:
|
|
- to:
|
|
- podSelector: {}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|