33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
# Коллектору нужны только DNS, Kafka и Vault (агент-инжектор). Входящие — только health-check kubelet'а.
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: audit-collector
|
||
spec:
|
||
podSelector: {}
|
||
policyTypes: [Ingress, Egress]
|
||
ingress:
|
||
- ports:
|
||
- {port: 13133, protocol: TCP} # health_check (liveness/readiness)
|
||
egress:
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: kube-system}
|
||
podSelector:
|
||
matchLabels: {k8s-app: kube-dns}
|
||
- ipBlock: {cidr: 169.254.25.10/32} # nodelocaldns kubespray; TODO(verify): enable_nodelocaldns в контуре
|
||
ports:
|
||
- {port: 53, protocol: UDP}
|
||
- {port: 53, protocol: TCP}
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: kafka}
|
||
ports:
|
||
# client-листенер SASL_SSL: bootstrap kafka-kafka-contour и advertised-адреса подов controller-headless
|
||
- {port: 9092, protocol: TCP}
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: vault}
|
||
ports:
|
||
- {port: 8200, protocol: TCP} # vault-vault-contour.vault.svc:8200 (AGENT_INJECT_VAULT_ADDR)
|