K8s network policy - Revision history

Busk at 20:01, 8 July 2023

2023-07-08T20:01:42Z

2023-07-08T20:00:58Z

2023-07-08T19:59:02Z

2023-07-08T15:53:21Z

2023-07-08T14:07:41Z

2023-07-08T12:34:12Z

2023-04-08T15:26:47Z

2023-04-08T13:13:57Z

2023-04-04T00:45:23Z

2023-04-04T00:44:54Z

@@ Line 3: / Line 3: @@
 ## Example of Wordpress with Egress Isolation
-egress--dns.yaml
+### egress--dns.yaml
 ```
 ---
@@ Line 29: / Line 29: @@
 ```
-egress--internet-http-https.yaml
+### egress--internet-http-https.yaml
 ```
 ---
@@ Line 56: / Line 56: @@
 ```
-egress--wordpress-to-mariadb.yaml
+### egress--wordpress-to-mariadb.yaml
 ```
 apiVersion: networking.k8s.io/v1
@@ Line 79: / Line 79: @@
 ```
-egress--email-submission.yaml
+### egress--email-submission.yaml
 ```
 ---
@@ Line 99: / Line 99: @@
 ```
 ```
 kubectl apply -f ../yaml/egress--dns.yaml -f ../yaml/egress--internet-http-https.yaml -f ../yaml/egress--wordpress-to-mariadb.yaml -f ../yaml/egress--email-submission.yaml

@@ Line 77: / Line 77: @@
          - protocol: TCP
            port: 3306
 ```

← Older revision		Revision as of 19:59, 8 July 2023
Line 1:		Line 1:
		+	# Examples
		+
		+	## Example of Wordpress with Egress Isolation
		+
		+	egress--dns.yaml
		+	```
		+	---
		+	apiVersion: networking.k8s.io/v1
		+	kind: NetworkPolicy
		+	metadata:
		+	name: egress-dns
		+	spec:
		+	podSelector: {}
		+	policyTypes:
		+	- Egress
		+	egress:
		+	- to:
		+	- namespaceSelector:
		+	matchLabels:
		+	kubernetes.io/metadata.name: kube-system
		+	podSelector:
		+	matchLabels:
		+	k8s-app: kube-dns
		+	ports:
		+	- protocol: TCP
		+	port: 53
		+	- protocol: UDP
		+	port: 53
		+	```
		+
		+	egress--internet-http-https.yaml
		+	```
		+	---
		+	apiVersion: networking.k8s.io/v1
		+	kind: NetworkPolicy
		+	metadata:
		+	name: egress-internet-http-https
		+	spec:
		+	podSelector: {}
		+	policyTypes:
		+	- Egress
		+	egress:
		+	- to:
		+	- ipBlock:
		+	cidr: 0.0.0.0/0
		+	except:
		+	- 10.0.0.0/8
		+	- 192.168.0.0/16
		+	- 172.16.0.0/20
		+	ports:
		+	- protocol: TCP
		+	port: 443
		+	- protocol: TCP
		+	port: 80
		+
		+	```
		+
		+	egress--wordpress-to-mariadb.yaml
		+	```
		+	apiVersion: networking.k8s.io/v1
		+	kind: NetworkPolicy
		+	metadata:
		+	name: egress--wordpress-to-mariadb
		+	spec:
		+	policyTypes:
		+	- Egress
		+	podSelector:
		+	matchLabels:
		+	app.kubernetes.io/name: wordpress
		+	egress:
		+	- to:
		+	- namespaceSelector: {}
		+	podSelector:
		+	matchLabels:
		+	app.kubernetes.io/name: mariadb
		+	ports:
		+	- protocol: TCP
		+	port: 3306
		+	```
		+
		+
	# Internet Only		# Internet Only
	- https://stackoverflow.com/questions/57789969/kubernetes-networkpolicy-allow-external-traffic-to-internet-only		- https://stackoverflow.com/questions/57789969/kubernetes-networkpolicy-allow-external-traffic-to-internet-only

← Older revision		Revision as of 15:53, 8 July 2023
Line 2:		Line 2:
	- https://stackoverflow.com/questions/57789969/kubernetes-networkpolicy-allow-external-traffic-to-internet-only		- https://stackoverflow.com/questions/57789969/kubernetes-networkpolicy-allow-external-traffic-to-internet-only

		+	# Guide
		+	- https://snyk.io/blog/kubernetes-network-policy-best-practices/
		+
		+	# Mote

	https://loft.sh/blog/kubernetes-network-policies-for-isolating-namespaces/		https://loft.sh/blog/kubernetes-network-policies-for-isolating-namespaces/

← Older revision		Revision as of 14:07, 8 July 2023
Line 1:		Line 1:
		+	# Internet Only
		+	- https://stackoverflow.com/questions/57789969/kubernetes-networkpolicy-allow-external-traffic-to-internet-only
		+
		+
	https://loft.sh/blog/kubernetes-network-policies-for-isolating-namespaces/		https://loft.sh/blog/kubernetes-network-policies-for-isolating-namespaces/

@@ Line 49: / Line 49: @@
 spec:
    podSelector: {}
    egress:
    - to:
      - namespaceSelector:
          matchLabels:
-           networking/namespace: kube-system
+           kubernetes.io/metadata.name: kube-system
        podSelector:
          matchLabels:
@@ Line 62: / Line 65: @@
      - protocol: UDP
        port: 53
 ```

@@ Line 38: / Line 38: @@
          - port: 53
            protocol: TCP
 ```

← Older revision		Revision as of 13:13, 8 April 2023
Line 5:		Line 5:

	https://editor.networkpolicy.io/?id=u7ZyunLd9YSsf9Da		https://editor.networkpolicy.io/?id=u7ZyunLd9YSsf9Da
		+
		+	https://cloud.redhat.com/blog/guide-to-kubernetes-egress-network-policies

	k8s core DNS example egress		k8s core DNS example egress

← Older revision		Revision as of 00:45, 4 April 2023
Line 4:		Line 4:
	https://kubernetes.io/docs/concepts/services-networking/network-policies/		https://kubernetes.io/docs/concepts/services-networking/network-policies/

		+	https://editor.networkpolicy.io/?id=u7ZyunLd9YSsf9Da

	k8s core DNS example egress		k8s core DNS example egress

← Older revision		Revision as of 00:44, 4 April 2023
Line 3:		Line 3:

	https://kubernetes.io/docs/concepts/services-networking/network-policies/		https://kubernetes.io/docs/concepts/services-networking/network-policies/
		+
		+
		+	k8s core DNS example egress
		+	```
		+	apiVersion: networking.k8s.io/v1
		+	kind: NetworkPolicy
		+	metadata:
		+	name: foo
		+	spec:
		+	podSelector:
		+	matchLabels:
		+	run: nginx
		+	policyTypes:
		+	- Egress
		+	egress:
		+	- to:
		+	- ipBlock:
		+	cidr: 192.168.0.0/16
		+	ports:
		+	- protocol: TCP
		+	port: 80
		+	endPort: 81
		+	- to:
		+	- namespaceSelector: {}
		+	podSelector:
		+	matchLabels:
		+	k8s-app: kube-dns
		+	ports:
		+	- port: 53
		+	protocol: UDP
		+	- port: 53
		+	protocol: TCP
		+	```