feat: allow namespace internal traffic from clusterwide policy

2024-02-19 16:07:23 +01:00
parent f2db2db473
commit bd46a4978e
2 changed files with 28 additions and 63 deletions
@@ -1,63 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: allow-namespace-traffic
-  annotations:
-    policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
-    policies.kyverno.io/subject: Namespace, NetworkPolicy
-    kyverno.io/kyverno-version: 1.7.0
-    policies.kyverno.io/minversion: 1.7.0
-    kyverno.io/kubernetes-version: "1.23"
-    policies.kyverno.io/description: >-
-      Allow all ingress/egress traffic within a namespace.
-      Allow egress to any pods in the cluster
-      Allow DNS with layer 7 inspection
-spec:
-  generateExistingOnPolicyUpdate: true
-  rules:
-  - name: allow-namespace-traffic
-    match:
-      any:
-      - resources:
-          kinds:
-          - Namespace
-    generate:
-      synchronize: true
-      apiVersion: cilium.io/v2
-      kind: CiliumNetworkPolicy
-      name: allow-namespace-traffic
-      namespace: "{{request.object.metadata.name}}"
-      data:
-        metadata:
-          labels:
-            created-by: kyverno
-        spec:
-          endpointSelector: {}
-          description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
-          ingress:
-            - fromEndpoints:
-                - {}
-            - fromEndpoints:
-              - matchExpressions:
-                - key: io.kubernetes.pod.namespace
-                  operator: Exists
-          egress:
-            - toEndpoints:
-              - matchExpressions:
-                - key: io.kubernetes.pod.namespace
-                  operator: Exists
-              #authentication:
-              #  mode: "required"
-            - toEndpoints:
-                - matchLabels:
-                    io.kubernetes.pod.namespace: kube-system
-                    k8s-app: kube-dns
-              toPorts:
-                - ports:
-                    - port: "53"
-                      protocol: UDP
-                  rules:
-                    dns:
-                      - matchPattern: "*"
-              #authentication:
-              #  mode: "required"
@@ -0,0 +1,28 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-namespace-traffic
+spec:
+  description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+  egress:
+    - toEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: "*"