2martens/cloud-configuration
1
0
Fork 0
mirror of https://github.com/2martens/cloud-configuration.git synced 2026-10-17 16:46:51 +02:00
Code Issues Activity

Fixed network policies

Browse Source
This commit is contained in:
2martens
2023-11-18 12:24:21 +01:00
parent 71a85dc3ce
commit 35ef41ef45
3 changed files with 83 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/cluster_setup/templates/cilium/hubble-relay-networkpolicy.yaml
+40
View File
@@ -26,4 +26,44 @@ specs:
- ports:
- port: '4244'
protocol: TCP
- toEntities:
- world
toPorts:
- ports:
- port: '443'
protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: hubble-relay
namespace: kube-system
spec:
podSelector:
matchLabels:
k8s-app: hubble-relay
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
k8s-app: hubble-ui
ports:
- port: '80'
protocol: TCP
- port: '4245'
protocol: TCP
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- port: '53'
protocol: UDP
{{- end }}
helm/cluster_setup/templates/cilium/hubble-ui-networkpolicy.yaml
+40 -13
View File
@@ -16,6 +16,8 @@ specs:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '80'
protocol: TCP
- port: '4245'
protocol: TCP
- endpointSelector:
@@ -30,20 +32,45 @@ specs:
- ports:
- port: '16443'
protocol: TCP
# hubble ui -> hubble relay
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4245'
protocol: TCP
# hubble ui -> core dns
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: coredns
- toEntities:
- world
toPorts:
- ports:
- port: '53'
protocol: UDP
- port: '443'
protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: hubble-ui
namespace: kube-system
spec:
podSelector:
matchLabels:
k8s-app: hubble-ui
policyTypes:
- Egress
egress:
- to:
- podSelector:
matchLabels:
k8s-app: hubble-relay
ports:
- port: '80'
protocol: TCP
- port: '4245'
protocol: TCP
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- port: '53'
protocol: UDP
---
{{- end }}