mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
114 lines
2.9 KiB
YAML
114 lines
2.9 KiB
YAML
# WordPress faces the internet, so if it is ever taken over it should only
|
|
# reach its own database, DNS and the internet: not the LAN (NAS, router),
|
|
# the Kubernetes API or other namespaces. Ingress comes from Envoy, the
|
|
# mariadb-operator and the node itself (kubelet probes; 10.1.7.64 is the
|
|
# node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 192.168.1.204/32
|
|
- ipBlock:
|
|
cidr: 10.1.7.64/32
|
|
egress:
|
|
- to:
|
|
- podSelector: {}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
# The internet, which includes this site's own public address
|
|
# (wp-cron's loopback requests go out and come back through Envoy).
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: wordpress-from-envoy
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: wordpress
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
ports:
|
|
- port: 8000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: mariadb-from-operator
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mariadb
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: mariadb-system
|
|
ports:
|
|
- port: 3306
|
|
---
|
|
# cert-manager's HTTP-01 solver, which runs only while a certificate
|
|
# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
|
|
# through Envoy. The policies above let Envoy reach the app's port only,
|
|
# which left the solver unreachable (found 2026-10-26, when ynab's renewal
|
|
# hung).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: acme-http01-solver
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
acme.cert-manager.io/http01-solver: "true"
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
ports:
|
|
- port: 8089
|