51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
# CiliumClusterwideNetworkPolicies — endpointSelector-based only.
|
|
# These are safe to apply at any time independently of host-firewall.yaml.
|
|
#
|
|
# nodeSelector-based host firewall policies (etcd, BGP, SSH, etc.) live
|
|
# exclusively in host-firewall.yaml and must be applied as a unit.
|
|
|
|
---
|
|
# Allow all pods to reach the kube-apiserver regardless of which entity identity
|
|
# the node IP resolves to (kube-apiserver vs host in K3s embedded mode).
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: allow-kube-apiserver-egress
|
|
spec:
|
|
endpointSelector: {}
|
|
egress:
|
|
- toEntities:
|
|
- kube-apiserver
|
|
- host
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
|
|
# that address as reserved:world/cidr, not kube-apiserver.
|
|
- toCIDR:
|
|
- 10.72.123.235/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
|
|
---
|
|
# Cilium health checks: covers both node-level probes and the reserved:health
|
|
# endpoints that each Cilium agent creates (pod-CIDR IPs, identity=health).
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: allow-cilium-health
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
reserved:health: ""
|
|
ingress:
|
|
- fromEntities:
|
|
- remote-node
|
|
- host
|
|
egress:
|
|
- toEntities:
|
|
- remote-node
|
|
- host
|