ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

331
vendor/infrastructure/kube-system/network-policies.yaml vendored Normal file
View file

@ -0,0 +1,331 @@
---
# Cilium Gateway: reserved:ingress is the identity Cilium assigns to L7 LB listeners
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: gateway-internal
spec:
endpointSelector:
matchLabels:
"reserved:ingress": ""
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- host
- remote-node
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
# Relay gateway: allow public traffic to the shared reserved:ingress identity.
# Cilium uses the same ingress identity for Gateway API listeners, so this
# must be additive with the internal gateway policy above. Local testing and
# internal clients can also reach the relay listener from trusted subnets or host.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: gateway-relay
spec:
endpointSelector:
matchLabels:
"reserved:ingress": ""
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- host
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- ingress
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
- fromEntities:
- world
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "443"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
# CoreDNS: accept DNS queries from all pods cluster-wide,
# and reach out to the apiserver for zone sync.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: coredns
namespace: kube-system
spec:
endpointSelector:
matchLabels:
k8s-app: kube-dns
ingress:
- fromEntities:
- cluster
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- fromEntities:
- host
toPorts:
- ports:
- port: "8080"
protocol: TCP
- port: "8181"
protocol: TCP
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: network-dns
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- toEntities:
- world
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
# metrics-server: scraped by kubelet via host on 10250.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: metrics-server
namespace: kube-system
spec:
endpointSelector:
matchLabels:
k8s-app: metrics-server
ingress:
- fromEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "10250"
protocol: TCP
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEntities:
- host
- remote-node
- kube-apiserver
toPorts:
- ports:
- port: "10250"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
---
# local-path-provisioner: only needs the apiserver.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: local-path-provisioner
namespace: kube-system
spec:
endpointSelector:
matchLabels:
app: local-path-provisioner
ingress: []
egress:
- toEntities:
- kube-apiserver
- host
toPorts:
- ports:
- port: "6443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
---
# Hubble relay: reached by the Hubble CLI/observer on 4222 from the host.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-relay
namespace: kube-system
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: hubble-relay
ingress:
- fromEntities:
- host
toPorts:
- ports:
- port: "4222"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s:app.kubernetes.io/name: hubble-ui
toPorts:
- ports:
- port: "4245"
protocol: TCP
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "4244"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
---
# Hubble UI backend: talks to hubble-relay.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: hubble-ui
namespace: kube-system
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: hubble-ui
ingress:
- fromEntities:
- host
toPorts:
- ports:
- port: "8081"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
app.kubernetes.io/name: hubble-relay
toPorts:
- ports:
- port: "4245"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
---
# Host egress to kube-system pods (DNS, metrics, hubble relay).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-egress-kube-system
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- port: "10250"
protocol: TCP
- port: "8181"
protocol: TCP
- port: "8081"
protocol: TCP
- port: "4222"
protocol: TCP
- port: "8080"
protocol: TCP