mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
# WordPress faces the internet, so if it is ever taken over it should only
|
|
# reach its own database, DNS and the internet: not the LAN (NAS, router),
|
|
# the Kubernetes API or other namespaces. Ingress comes from Envoy, the
|
|
# mariadb-operator and the node itself (kubelet probes; 10.1.7.64 is the
|
|
# node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 192.168.1.204/32
|
|
- ipBlock:
|
|
cidr: 10.1.7.64/32
|
|
egress:
|
|
- to:
|
|
- podSelector: {}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
# The internet, which includes this site's own public address
|
|
# (wp-cron's loopback requests go out and come back through Envoy).
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: wordpress-from-envoy
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: wordpress
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
ports:
|
|
- port: 8000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: mariadb-from-operator
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mariadb
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: mariadb-system
|
|
ports:
|
|
- port: 3306
|