K3S-Cluster/home-cluster-ops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "remove network policies for now"

Browse Source 
This reverts commit 665de9090a.
This commit is contained in:
Edward Cheng
2024-06-09 14:19:45 +10:00
parent e94c276611
commit f3e452ab15
13 changed files with 241 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
kubernetes/rpi5-cluster/apps/cilium/ks.yaml
View File

@@ -12,4 +12,19 @@ spec:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-networkpolicies
namespace: kube-system
spec:
interval: 1h
path: ./kubernetes/rpi5-cluster/apps/cilium/networkpolicies
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops
dependsOn:
- name: cilium-app

21
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/coredns.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: coredns
namespace: kube-system
spec:
endpointSelector:
matchLabels:
k8s-app: kube-dns
egress:
- toEntities:
- world
toPorts:
- ports:
- port: "53"
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "6443"

19
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kube-dns.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-kube-dns
spec:
endpointSelector:
matchExpressions:
- key: rpi5.cluster.policy/egress-kube-dns
operator: NotIn
values:
- "false"
egress:
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"

21
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kubeapi.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-kubeapi
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-kubeapi: "true"
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "6443"
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "443"
- port: "6443"

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-namespace.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-namespace
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-namespace: "true"
egress:
- toEndpoints:
- {}

12
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-nodes.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-nodes
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-nodes: "true"
egress:
- toEntities:
- host
- remote-node

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world-with-lan.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-world-with-lan
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-world-with-lan: "true"
egress:
- toCIDRSet:
- cidr: 0.0.0.0/0

15
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-world
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-world: "true"
egress:
- toCIDRSet:
- cidr: 0.0.0.0/0
except:
- 192.168.1.0/24
- 192.168.2.0/24
- 100.64.0.0/10

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-namespace.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-namespace
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-namespace: "true"
ingress:
- fromEndpoints:
- {}

65
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nginx.yaml Normal file
View File

@@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-ingress
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-ingress: "true"
ingress:
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: ingress-nginx
namespace: ingress-nginx
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
egress:
- toEndpoints:
- matchLabels:
rpi5.cluster.policy/ingress-ingress: "true"
matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-ingress
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-ingress: "true"
egress:
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: egress-nginx
namespace: ingress-nginx
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
ingress:
- fromEndpoints:
- matchLabels:
rpi5.cluster.policy/egress-ingress: "true"
matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists

12
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nodes.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-nodes
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-nodes: "true"
ingress:
- fromEntities:
- host
- remote-node

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-world.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-world
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-world: "true"
ingress:
- fromEntities:
- world

16
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/local-path-provisioner.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: local-path-provisioner
namespace: kube-system
spec:
endpointSelector:
matchLabels:
app: local-path-provisioner
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "6443"