53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata: {name: default-deny, namespace: proxy-pool}
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes: [Ingress, Egress]
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata: {name: gateway-traffic, namespace: proxy-pool}
|
|
spec:
|
|
podSelector: {matchLabels: {app.kubernetes.io/name: proxy-gateway}}
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- ports: [{port: 8080, protocol: TCP}]
|
|
- from:
|
|
- namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}
|
|
ports: [{port: 9090, protocol: TCP}]
|
|
egress:
|
|
- to:
|
|
- namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
|
|
ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
|
|
- to:
|
|
- podSelector: {matchLabels: {app.kubernetes.io/name: proxy-controller}}
|
|
ports: [{port: 8443, protocol: TCP}]
|
|
# Gateway 需要连接任意公网目标；应用层 DestinationPolicy 仍拒绝私网、回环和元数据地址。
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except: [10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16]
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata: {name: control-plane-traffic, namespace: proxy-pool}
|
|
spec:
|
|
podSelector:
|
|
matchExpressions:
|
|
- {key: app.kubernetes.io/name, operator: In, values: [proxy-controller, proxy-checker]}
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: proxy-pool}}
|
|
- from:
|
|
- namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}
|
|
ports: [{port: 9090, protocol: TCP}]
|
|
egress:
|
|
- to:
|
|
- namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
|
|
ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
|
|
# Provider、健康目标及外部托管 PostgreSQL/Redis 的精确网段应在环境 Overlay 收紧。
|
|
- to: [{ipBlock: {cidr: 0.0.0.0/0}}]
|
|
|