60 lines
2.1 KiB
YAML
60 lines
2.1 KiB
YAML
# ---
|
|
# apiVersion: kyverno.io/v1
|
|
# kind: ClusterPolicy
|
|
# metadata:
|
|
# name: add-networkpolicy-dns
|
|
# labels:
|
|
# <<: {{ kubernetes_config.defaults.labels.deployment_labels | from_yaml }}
|
|
# annotations:
|
|
# ansible.kubernetes.io/path: {{ item }}
|
|
# policies.kyverno.io/title: Add Network Policy for DNS
|
|
# policies.kyverno.io/category: Multi-Tenancy, EKS Best Practices
|
|
# policies.kyverno.io/subject: NetworkPolicy
|
|
# kyverno.io/kyverno-version: 1.6.2
|
|
# policies.kyverno.io/minversion: 1.6.0
|
|
# kyverno.io/kubernetes-version: "1.23"
|
|
# policies.kyverno.io/description: >-
|
|
# By default, Kubernetes allows communications across all Pods within a cluster.
|
|
# The NetworkPolicy resource and a CNI plug-in that supports NetworkPolicy must be used to restrict
|
|
# communications. A default NetworkPolicy should be configured for each Namespace to
|
|
# default deny all ingress and egress traffic to the Pods in the Namespace. Application
|
|
# teams can then configure additional NetworkPolicy resources to allow desired traffic
|
|
# to application Pods from select sources. This policy will create a new NetworkPolicy resource
|
|
# named `default-deny` which will deny all traffic anytime a new Namespace is created.
|
|
# spec:
|
|
# generateExistingOnPolicyUpdate: true
|
|
# rules:
|
|
# - name: add-netpol-dns
|
|
# match:
|
|
# any:
|
|
# - resources:
|
|
# kinds:
|
|
# - Namespace
|
|
# exclude:
|
|
# any:
|
|
# - resources:
|
|
# namespaces:
|
|
# - kube-metrics
|
|
# - kube-policy
|
|
# - kube-system
|
|
# - default
|
|
# generate:
|
|
# apiVersion: networking.k8s.io/v1
|
|
# kind: NetworkPolicy
|
|
# name: allow-dns
|
|
# namespace: "{{'{{request.object.metadata.name}}'}}"
|
|
# synchronize: true
|
|
# data:
|
|
# spec:
|
|
# podSelector:
|
|
# matchLabels: {}
|
|
# policyTypes:
|
|
# - Egress
|
|
# egress:
|
|
# - to:
|
|
# - namespaceSelector:
|
|
# matchLabels:
|
|
# name: kube-system
|
|
# ports:
|
|
# - protocol: UDP
|
|
# port: 53 |