2martens/cloud-configuration
1
0
Fork 0
mirror of https://github.com/2martens/cloud-configuration.git synced 2026-10-17 08:37:56 +02:00
Code Issues Activity

Remove all policies that enforce node-level

Browse Source
This commit is contained in:
2martens
2023-11-17 16:38:50 +01:00
parent 1f9bca4d41
commit 38905422a3
10 changed files with 12 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml
-12
View File
@@ -1,12 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: world
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
egress:
# node -> world
- toEntities:
- world
helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml
-23
View File
@@ -1,23 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: api-server
spec:
nodeSelector:
# apply to manager nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# world -> api server
- toPorts:
- ports:
- port: '16443'
protocol: TCP
egress:
# api server -> kubelet
- toEntities:
- remote-node
toPorts:
- ports:
- port: '10250'
protocol: TCP
helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml
-39
View File
@@ -1,39 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: cilium-health
specs:
- endpointSelector:
# apply to health endpoints
matchLabels:
reserved:health: ''
ingress:
# cilium agent -> cilium agent
- fromEntities:
- host
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
- nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# cilium agent -> cilium agent
- fromEntities:
- health
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
egress:
# cilium agent -> cilium agent
- toEntities:
- health
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
helm/cluster_setup/templates/hostaccess-clusterwide-networkpolicy.yaml
-31
View File
@@ -1,31 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-access
spec:
nodeSelector:
matchLabels: { }
ingress:
- fromEntities:
- world
toPorts:
- ports:
- port: '22'
protocol: TCP
- fromEntities:
- world
icmps:
- fields:
- type: 8
family: IPv4
- type: 8
family: IPv6
egress:
- toEntities:
- world
icmps:
- fields:
- type: 8
family: IPv4
- type: 8
family: IPv6
helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml
+3 -22
View File
@@ -1,30 +1,10 @@
{{- if .Values.cilium.enabled }}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-relay
namespace: kube-system
specs:
- nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# hubble relay -> hubble agent
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4244'
protocol: TCP
egress:
# kubelet -> hubble relay probes
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4245'
protocol: TCP
- endpointSelector:
# apply to hubble relay pods
matchLabels:
@@ -45,4 +25,5 @@ specs:
toPorts:
- ports:
- port: '4244'
protocol: TCP
protocol: TCP
{{- end }}
helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml
+3 -27
View File
@@ -1,35 +1,10 @@
{{- if .Values.cilium.enabled }}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-ui
namespace: kube-system
specs:
- nodeSelector:
# apply to master nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# hubble ui -> api server
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '16443'
protocol: TCP
- endpointSelector:
# apply to core dns endpoints
matchLabels:
io.cilium.k8s.policy.serviceaccount: coredns
ingress:
# hubble ui -> core dns
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '53'
protocol: UDP
- endpointSelector:
# apply to hubble relay endpoints
matchLabels:
@@ -70,4 +45,5 @@ specs:
toPorts:
- ports:
- port: '53'
protocol: UDP
protocol: UDP
{{- end }}
helm/cluster_setup/templates/kubedns-networkpolicy.yaml
+6 -31
View File
@@ -1,40 +1,14 @@
{{- if .Values.cilium.enabled }}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: kube-dns
namespace: kube-system
specs:
- nodeSelector:
# apply to master nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# core dns -> api server
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '16443'
protocol: TCP
- nodeSelector:
# apply to all nodes
matchLabels: {}
egress:
# kubelet -> core dns probes
- toEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '8080'
protocol: TCP
- port: '8181'
protocol: TCP
- endpointSelector:
# apply to core dns pods
matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
io.cilium.k8s.policy.serviceaccount: "coredns"
ingress:
# kubelet -> core dns probes
- fromEntities:
@@ -48,8 +22,8 @@ specs:
# prometheus -> dns metrics
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
k8s:io.kubernetes.pod.namespace: observability
io.cilium.k8s.policy.serviceaccount: "prometheus-kube-prometheus-prometheus"
io.kubernetes.pod.namespace: "observability"
toPorts:
- ports:
- port: '9153'
@@ -62,4 +36,5 @@ specs:
- port: '53'
protocol: TCP
- port: '53'
protocol: UDP
protocol: UDP
{{- end }}
helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml
-25
View File
@@ -1,25 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: kubelet
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# prometheus -> kubelet
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
io.kubernetes.pod.namespace: observability
toPorts:
- ports:
- port: '10250'
protocol: TCP
# api server -> kubelet
- fromEntities:
- kube-apiserver
toPorts:
- ports:
- port: '10250'
protocol: TCP
helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml
-37
View File
@@ -1,37 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: monitoring
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# prometheus -> monitoring ports
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
io.kubernetes.pod.namespace: observability
toPorts:
- ports:
- port: '9100'
protocol: TCP
- port: '9962'
protocol: TCP
- port: '9963'
protocol: TCP
- port: '9965'
protocol: TCP
- port: '10257'
protocol: TCP
- port: '10259'
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
io.kubernetes.pod.namespace: observability
toPorts:
- ports:
- port: '9090'
protocol: TCP
helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml
-24
View File
@@ -1,24 +0,0 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: cilium-vxlan
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# node -> vxlan
- fromEntities:
- remote-node
toPorts:
- ports:
- port: '8472'
protocol: UDP
egress:
# node -> vxlan
- toEntities:
- remote-node
toPorts:
- ports:
- port: '8472'
protocol: UDP