tegwick
4a06c0884a
Core in-cluster CronJobs with cnpg-option-a-backup image + NetworkPolicy; R01 activity-core schedule enabled; status healthy; evidence recorded.
72 lines
1.8 KiB
YAML
72 lines
1.8 KiB
YAML
# Allow Option A backup Jobs to reach kube-api, DNS, and HTTPS offsite (Nextcloud).
|
|
# databases/ has default-deny; CNPG cluster pods already have kube-api egress by label.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-cnpg-option-a-backup
|
|
namespace: databases
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-apps
|
|
railiance.apps/backup-lane: option-a
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
railiance.apps/backup-lane: option-a
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# kube-api (in-cluster service + node port forms)
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
# DNS
|
|
- ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Nextcloud WebDAV HTTPS (and general HTTPS for future mirrors)
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
to:
|
|
- namespaceSelector: {}
|
|
# allow all namespaces + external via empty podSelector not possible;
|
|
# for external CIDR use 0.0.0.0/0
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
---
|
|
# Some CNI stacks need separate CIDR-only rules for kube-api ClusterIP
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-cnpg-option-a-backup-kubeapi-cidr
|
|
namespace: databases
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-apps
|
|
railiance.apps/backup-lane: option-a
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
railiance.apps/backup-lane: option-a
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.43.0.0/16
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.42.0.0/16
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|