mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
95 lines
2.6 KiB
YAML
95 lines
2.6 KiB
YAML
# Vault holds every secret, so only ESO, the UI through Envoy, and the
|
|
# node reach it (the API server calls the injector's webhook from there;
|
|
# 10.1.7.64 is the node's Calico VXLAN address,
|
|
# projectcalico.org/IPv4VXLANTunnelAddr). Nothing uses agent injection.
|
|
# The pods reach each other (raft on 8201, the OIDC job), DNS, the API
|
|
# server (service registration labels the active pod, the injector) and
|
|
# the internet (the OIDC login through authentik's public address).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 192.168.1.204/32
|
|
- ipBlock:
|
|
cidr: 10.1.7.64/32
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: external-secrets
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: external-secrets
|
|
ports:
|
|
- port: 8200
|
|
egress:
|
|
- to:
|
|
- podSelector: {}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 192.168.1.204/32
|
|
ports:
|
|
- port: 16443
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
---
|
|
# cert-manager's HTTP-01 solver, which runs only while a certificate
|
|
# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
|
|
# through Envoy. The policies above let Envoy reach the app's port only,
|
|
# which left the solver unreachable (found 2026-10-26, when ynab's renewal
|
|
# hung).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: acme-http01-solver
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
acme.cert-manager.io/http01-solver: "true"
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: envoy-gateway-system
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: envoy
|
|
ports:
|
|
- port: 8089
|