2martens/cloud-configuration
1
0
Fork 0
mirror of https://github.com/2martens/cloud-configuration.git synced 2026-10-19 17:36:51 +02:00
Code Issues Activity

Added network policies for core components of cluster

Browse Source
This commit is contained in:
2martens
2023-11-16 23:44:48 +01:00
parent f751ff7a74
commit 7bd028e847
8 changed files with 308 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/cluster_setup/templates/kubedns-networkpolicy.yaml
+65
View File
@@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: kube-dns
namespace: kube-system
specs:
- nodeSelector:
# apply to master nodes
matchLabels:
node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
ingress:
# core dns -> api server
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '16443'
protocol: TCP
- nodeSelector:
# apply to all nodes
matchLabels: {}
egress:
# kubelet -> core dns probes
- toEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
toPorts:
- ports:
- port: '8080'
protocol: TCP
- port: '8181'
protocol: TCP
- endpointSelector:
# apply to core dns pods
matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: coredns
ingress:
# kubelet -> core dns probes
- fromEntities:
- host
toPorts:
- ports:
- port: '8080'
protocol: TCP
- port: '8181'
protocol: TCP
# prometheus -> dns metrics
- fromEndpoints:
- matchLabels:
k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
k8s:io.kubernetes.pod.namespace: observability
toPorts:
- ports:
- port: '9153'
protocol: TCP
# cluster -> dns
- fromEntities:
- cluster
toPorts:
- ports:
- port: '53'
protocol: TCP
- port: '53'
protocol: UDP