Dustin C. Hatch
4243823ba5
Since the IP address assigned to the ingress controller is now managed by keepalived and known to Kubernetes, the network policy needs to allow access to it by pod namespace rather than IP address. It seems that the former takes precedence over the latter, so even though the IP address was explicitly allowed, traffic was not permitted because it was destined for a Kubernetes service that was not.
48 lines
966 B
YAML
48 lines
966 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: invoice-ninja
|
|
labels:
|
|
app.kubernetes.io/name: invoice-ninja
|
|
app.kubernetes.io/component: invoice-ninja
|
|
spec:
|
|
egress:
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/part-of: invoice-ninja
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 172.30.0.12/32
|
|
ports:
|
|
- port: 25
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
ports:
|
|
- port: 80
|
|
- port: 443
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 172.30.0.1/32
|
|
ports:
|
|
- port: 3128
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: invoice-ninja
|
|
policyTypes:
|
|
- Egress
|