31 lines
1021 B
YAML
31 lines
1021 B
YAML
# Дополняет общую audit-collector (podSelector: {} — действует и на под Job'а: DNS, Vault, Kafka).
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: idp-actions-bootstrap
|
||
spec:
|
||
podSelector:
|
||
matchLabels:
|
||
security-audit/job: idp-actions-bootstrap
|
||
policyTypes: [Ingress, Egress]
|
||
ingress:
|
||
- ports:
|
||
- {port: 15021, protocol: TCP} # readiness istio-proxy (kubelet)
|
||
egress:
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: zitadel}
|
||
podSelector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: idp-contour
|
||
app.kubernetes.io/component: start
|
||
ports:
|
||
- {port: 8080, protocol: TCP}
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: istio-system}
|
||
podSelector:
|
||
matchLabels: {app: istiod}
|
||
ports:
|
||
- {port: 15012, protocol: TCP} # xDS и сертификаты istio-proxy
|