62 lines
1.8 KiB
YAML
62 lines
1.8 KiB
YAML
# services/hermes-scm-broker/networkpolicy.yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: hermes-scm-broker-isolation
|
|
namespace: hermes-scm
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-scm-broker
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: hermes
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-agent
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: hermes
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-execution-mediator
|
|
ports:
|
|
- {protocol: TCP, port: 9081}
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- {protocol: UDP, port: 53}
|
|
- {protocol: TCP, port: 53}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: vault
|
|
podSelector:
|
|
matchLabels:
|
|
app: vault
|
|
ports:
|
|
- {protocol: TCP, port: 8200}
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 192.168.22.9/32
|
|
# Pod egress to the forge VIP is DNAT-ed to the ingress pods before
|
|
# policy evaluation, so the VIP ipBlock alone never matches; allow the
|
|
# ingress pods themselves or every broker->forge read is rejected.
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: traefik
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- {protocol: TCP, port: 443}
|