99 lines
2.0 KiB
YAML
99 lines
2.0 KiB
YAML
# kubernetes/networkpolicy/networkpolicy.yaml
|
|
|
|
# Rule 1 — Default deny ALL ingress + egress in namespace
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-all
|
|
namespace: todo-app
|
|
spec:
|
|
podSelector: {} # applies to ALL pods
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
---
|
|
# Rule 2 — Frontend can receive from Gateway only
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-gateway-to-frontend
|
|
namespace: todo-app
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
tier: web
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: nginx-gateway
|
|
---
|
|
# Rule 3 — Backend can receive from Gateway only
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-gateway-to-backend
|
|
namespace: todo-app
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
tier: api
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: nginx-gateway
|
|
---
|
|
# Rule 4 — MongoDB accepts connections from backend ONLY
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-backend-to-mongo
|
|
namespace: todo-app
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
tier: database
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
tier: api # only backend pods
|
|
ports:
|
|
- port: 27017
|
|
---
|
|
# Rule 5 — Backend can talk to MongoDB + DNS only
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: backend-egress
|
|
namespace: todo-app
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
tier: api
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# Allow MongoDB
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
tier: database
|
|
ports:
|
|
- port: 27017
|
|
# Allow DNS resolution
|
|
- to:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|