2martens/cloud-configuration
1
0
Fork 0
mirror of https://github.com/2martens/cloud-configuration.git synced 2026-10-17 08:37:56 +02:00
Code Issues Activity

Added network policies for core components of cluster

Browse Source
This commit is contained in:
2martens
2023-11-16 23:44:48 +01:00
parent f751ff7a74
commit 7bd028e847
8 changed files with 308 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: world
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
egress:
# node -> world
- toEntities:
- world
helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml
+23
View File
@@ -0,0 +1,23 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: api-server
spec:
nodeSelector:
# apply to manager nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# world -> api server
- toPorts:
- ports:
- port: '16443'
protocol: TCP
egress:
# api server -> kubelet
- toEntities:
- remote-node
toPorts:
- ports:
- port: '10250'
protocol: TCP
helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: cilium-health
specs:
- endpointSelector:
# apply to health endpoints
matchLabels:
reserved:health: ''
ingress:
# cilium agent -> cilium agent
- fromEntities:
- host
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
- nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# cilium agent -> cilium agent
- fromEntities:
- health
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
egress:
# cilium agent -> cilium agent
- toEntities:
- health
- remote-node
toPorts:
- ports:
- port: '4240'
protocol: TCP
helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml
+48
View File
@@ -0,0 +1,48 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-relay
namespace: kube-system
specs:
- nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# hubble relay -> hubble agent
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4244'
protocol: TCP
egress:
# kubelet -> hubble relay probes
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4245'
protocol: TCP
- endpointSelector:
# apply to hubble relay pods
matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
ingress:
# kubelet -> hubble relay probes
- fromEntities:
- host
toPorts:
- ports:
- port: '4245'
protocol: TCP
egress:
# hubble relay -> hubble agent
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: '4244'
protocol: TCP
helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml
+73
View File
@@ -0,0 +1,73 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-ui
namespace: kube-system
specs:
- nodeSelector:
# apply to master nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# hubble ui -> api server
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '16443'
protocol: TCP
- endpointSelector:
# apply to core dns endpoints
matchLabels:
io.cilium.k8s.policy.serviceaccount: coredns
ingress:
# hubble ui -> core dns
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '53'
protocol: UDP
- endpointSelector:
# apply to hubble relay endpoints
matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
ingress:
# hubble ui -> hubble relay
- fromEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
toPorts:
- ports:
- port: '4245'
protocol: TCP
- endpointSelector:
# apply to hubble ui endpoints
matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-ui
egress:
# hubble ui -> api server
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: '16443'
protocol: TCP
# hubble ui -> hubble relay
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: hubble-relay
toPorts:
- ports:
- port: '4245'
protocol: TCP
# hubble ui -> core dns
- toEndpoints:
- matchLabels:
io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '53'
protocol: UDP
helm/cluster_setup/templates/kubedns-networkpolicy.yaml
+65
View File
@@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: kube-dns
namespace: kube-system
specs:
- nodeSelector:
# apply to master nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# core dns -> api server
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '16443'
protocol: TCP
- nodeSelector:
# apply to all nodes
matchLabels: {}
egress:
# kubelet -> core dns probes
- toEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '8080'
protocol: TCP
- port: '8181'
protocol: TCP
- endpointSelector:
# apply to core dns pods
matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
ingress:
# kubelet -> core dns probes
- fromEntities:
- host
toPorts:
- ports:
- port: '8080'
protocol: TCP
- port: '8181'
protocol: TCP
# prometheus -> dns metrics
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
k8s:io.kubernetes.pod.namespace: observability
toPorts:
- ports:
- port: '9153'
protocol: TCP
# cluster -> dns
- fromEntities:
- cluster
toPorts:
- ports:
- port: '53'
protocol: TCP
- port: '53'
protocol: UDP
helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: kubelet
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# prometheus -> kubelet
- fromEndpoints:
- matchLabels:
app: kube-prometheus-stack-prometheus
toPorts:
- ports:
- port: '10250'
protocol: TCP
# api server -> kubelet
- fromEntities:
- kube-apiserver
toPorts:
- ports:
- port: '10250'
protocol: TCP
helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: cilium-vxlan
spec:
nodeSelector:
# apply to all nodes
matchLabels: {}
ingress:
# node -> vxlan
- fromEntities:
- remote-node
toPorts:
- ports:
- port: '8472'
protocol: UDP
egress:
# node -> vxlan
- toEntities:
- remote-node
toPorts:
- ports:
- port: '8472'
protocol: UDP