Skip to content

Commit 2e9720d

Browse files
author
mcbloch
committed
update network policy to a hopefully working version
1 parent f3b7f8b commit 2e9720d

1 file changed

Lines changed: 58 additions & 47 deletions

File tree

‎sdk/kubernetes/kompose.go‎

Lines changed: 58 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,13 @@ func init() {
4242
type Kompose struct {
4343
pulumi.ResourceState
4444

45-
ns *corev1.Namespace
46-
innspol *netwv1.NetworkPolicy
47-
dnspol *netwv1.NetworkPolicy
48-
internspol *netwv1.NetworkPolicy
49-
internetpol *netwv1.NetworkPolicy
45+
ns *corev1.Namespace
46+
denyAllPol *netwv1.NetworkPolicy
47+
dnsUdpPol *netwv1.NetworkPolicy
48+
dnsTcpPol *netwv1.NetworkPolicy
49+
internetPol *netwv1.NetworkPolicy
50+
sameNamespaceIngressPol *netwv1.NetworkPolicy
51+
sameNamespaceEgressPol *netwv1.NetworkPolicy
5052

5153
cg *yamlv2.ConfigGroup
5254
svcs ServiceMapMapOutput
@@ -242,8 +244,25 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
242244
return
243245
}
244246

245-
// => NetworkPolicy to grant all network interactions within the namespace
246-
kmp.innspol, err = netwv1.NewNetworkPolicy(ctx, "allow-all-within-namespace", &netwv1.NetworkPolicyArgs{
247+
// => NetworkPolicy baseline: deny all ingress and egress traffic
248+
kmp.denyAllPol, err = netwv1.NewNetworkPolicy(ctx, "deny-all", &netwv1.NetworkPolicyArgs{
249+
Metadata: metav1.ObjectMetaArgs{
250+
Namespace: kmp.ns.Metadata.Name().Elem(),
251+
},
252+
Spec: netwv1.NetworkPolicySpecArgs{
253+
PodSelector: metav1.LabelSelectorArgs{}, // Selects all Pods in the namespace
254+
PolicyTypes: pulumi.ToStringArray([]string{
255+
"Ingress",
256+
"Egress",
257+
}),
258+
},
259+
}, opts...)
260+
if err != nil {
261+
return
262+
}
263+
264+
// => NetworkPolicy to allow communication within the same namespace (ingress)
265+
kmp.sameNamespaceIngressPol, err = netwv1.NewNetworkPolicy(ctx, "allow-same-namespace-ingress", &netwv1.NetworkPolicyArgs{
247266
Metadata: metav1.ObjectMetaArgs{
248267
Namespace: kmp.ns.Metadata.Name().Elem(),
249268
},
@@ -258,6 +277,22 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
258277
},
259278
},
260279
},
280+
PolicyTypes: pulumi.ToStringArray([]string{
281+
"Ingress",
282+
}),
283+
},
284+
}, opts...)
285+
if err != nil {
286+
return
287+
}
288+
289+
// => NetworkPolicy to allow communication within the same namespace (egress)
290+
kmp.sameNamespaceEgressPol, err = netwv1.NewNetworkPolicy(ctx, "allow-same-namespace-egress", &netwv1.NetworkPolicyArgs{
291+
Metadata: metav1.ObjectMetaArgs{
292+
Namespace: kmp.ns.Metadata.Name().Elem(),
293+
},
294+
Spec: netwv1.NetworkPolicySpecArgs{
295+
PodSelector: metav1.LabelSelectorArgs{}, // Selects all Pods in the namespace
261296
Egress: netwv1.NetworkPolicyEgressRuleArray{
262297
netwv1.NetworkPolicyEgressRuleArgs{
263298
To: netwv1.NetworkPolicyPeerArray{
@@ -268,7 +303,6 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
268303
},
269304
},
270305
PolicyTypes: pulumi.ToStringArray([]string{
271-
"Ingress",
272306
"Egress",
273307
}),
274308
},
@@ -277,23 +311,16 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
277311
return
278312
}
279313

280-
// => NetworkPolicy to grant DNS resolution (complex scenarios could require
281-
// to reach other pods in the namespace, e.g. not a scenario that fits into
282-
// the sdk.ctfer.io/ExposedMonopod architecture, which then would use headless
283-
// services so DNS resolution).
284-
kmp.dnspol, err = netwv1.NewNetworkPolicy(ctx, "allow-kube-dns", &netwv1.NetworkPolicyArgs{
314+
// => NetworkPolicy to grant DNS resolution via UDP to cluster DNS
315+
kmp.dnsUdpPol, err = netwv1.NewNetworkPolicy(ctx, "allow-dns-udp", &netwv1.NetworkPolicyArgs{
285316
Metadata: metav1.ObjectMetaArgs{
286317
Namespace: kmp.ns.Metadata.Name(),
287-
Labels: pulumi.StringMap{
288-
"app.kubernetes.io/component": pulumi.String("chall-manager"),
289-
"app.kubernetes.io/part-of": pulumi.String("chall-manager"),
290-
},
291318
},
292319
Spec: netwv1.NetworkPolicySpecArgs{
320+
PodSelector: metav1.LabelSelectorArgs{},
293321
PolicyTypes: pulumi.ToStringArray([]string{
294322
"Egress",
295323
}),
296-
PodSelector: metav1.LabelSelectorArgs{},
297324
Egress: netwv1.NetworkPolicyEgressRuleArray{
298325
netwv1.NetworkPolicyEgressRuleArgs{
299326
To: netwv1.NetworkPolicyPeerArray{
@@ -303,22 +330,13 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
303330
"kubernetes.io/metadata.name": pulumi.String("kube-system"),
304331
},
305332
},
306-
PodSelector: metav1.LabelSelectorArgs{
307-
MatchLabels: pulumi.StringMap{
308-
"k8s-app": pulumi.String("kube-dns"),
309-
},
310-
},
311333
},
312334
},
313335
Ports: netwv1.NetworkPolicyPortArray{
314336
netwv1.NetworkPolicyPortArgs{
315337
Port: pulumi.Int(53),
316338
Protocol: pulumi.String("UDP"),
317339
},
318-
netwv1.NetworkPolicyPortArgs{
319-
Port: pulumi.Int(53),
320-
Protocol: pulumi.String("TCP"),
321-
},
322340
},
323341
},
324342
},
@@ -328,14 +346,10 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
328346
return
329347
}
330348

331-
// => NetworkPolicy to deny all scenarios from reaching adjacent namespaces
332-
kmp.internspol, err = netwv1.NewNetworkPolicy(ctx, "deny-inter-ns", &netwv1.NetworkPolicyArgs{
349+
// => NetworkPolicy to grant DNS resolution via TCP to cluster DNS
350+
kmp.dnsTcpPol, err = netwv1.NewNetworkPolicy(ctx, "allow-dns-tcp", &netwv1.NetworkPolicyArgs{
333351
Metadata: metav1.ObjectMetaArgs{
334352
Namespace: kmp.ns.Metadata.Name(),
335-
Labels: pulumi.StringMap{
336-
"app.kubernetes.io/component": pulumi.String("chall-manager"),
337-
"app.kubernetes.io/part-of": pulumi.String("chall-manager"),
338-
},
339353
},
340354
Spec: netwv1.NetworkPolicySpecArgs{
341355
PodSelector: metav1.LabelSelectorArgs{},
@@ -347,18 +361,18 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
347361
To: netwv1.NetworkPolicyPeerArray{
348362
netwv1.NetworkPolicyPeerArgs{
349363
NamespaceSelector: metav1.LabelSelectorArgs{
350-
MatchExpressions: metav1.LabelSelectorRequirementArray{
351-
metav1.LabelSelectorRequirementArgs{
352-
Key: pulumi.String("kubernetes.io/metadata.name"),
353-
Operator: pulumi.String("NotIn"),
354-
Values: pulumi.StringArray{
355-
kmp.ns.Metadata.Name().Elem(),
356-
},
357-
},
364+
MatchLabels: pulumi.StringMap{
365+
"kubernetes.io/metadata.name": pulumi.String("kube-system"),
358366
},
359367
},
360368
},
361369
},
370+
Ports: netwv1.NetworkPolicyPortArray{
371+
netwv1.NetworkPolicyPortArgs{
372+
Port: pulumi.Int(53),
373+
Protocol: pulumi.String("TCP"),
374+
},
375+
},
362376
},
363377
},
364378
},
@@ -367,14 +381,10 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
367381
return
368382
}
369383

370-
// => NetworkPolicy to grant access to Internet IPs (required to download fonts, images, etc.)
371-
kmp.internetpol, err = netwv1.NewNetworkPolicy(ctx, "allow-internet", &netwv1.NetworkPolicyArgs{
384+
// => NetworkPolicy to allow all internet egress (all ports and protocols)
385+
kmp.internetPol, err = netwv1.NewNetworkPolicy(ctx, "allow-internet-all", &netwv1.NetworkPolicyArgs{
372386
Metadata: metav1.ObjectMetaArgs{
373387
Namespace: kmp.ns.Metadata.Name(),
374-
Labels: pulumi.StringMap{
375-
"app.kubernetes.io/component": pulumi.String("chall-manager"),
376-
"app.kubernetes.io/part-of": pulumi.String("chall-manager"),
377-
},
378388
},
379389
Spec: netwv1.NetworkPolicySpecArgs{
380390
PodSelector: metav1.LabelSelectorArgs{},
@@ -391,6 +401,7 @@ func (kmp *Kompose) provision(ctx *pulumi.Context, in KomposeArgsOutput, opts ..
391401
"10.0.0.0/8", // internal Kubernetes cluster IP range
392402
"172.16.0.0/12", // common internal IP range
393403
"192.168.0.0/16", // common internal IP range
404+
"198.18.0.0/15", // private benchmark testing range
394405
}),
395406
},
396407
},

0 commit comments

Comments
 (0)