devops/gitops
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

networkpolicy: default-deny + sirf zaroori raasta

Browse Source
This commit is contained in:
devops 2026-09-17 02:40:27 +00:00
parent 5a107c08d2
commit 1585c8a212
2 changed files with 72 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
manifests/demo-app/networkpolicy.yaml Normal file
View File

@ -0,0 +1,36 @@
# Pehle sab band. Pod compromise ho to wo cluster me idhar-udhar na ja sake.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: demo-app
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
---
# Ab sirf jo chahiye wahi khola: app port par traffic andar, DNS bahar.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-app
namespace: demo-app
spec:
podSelector:
matchLabels:
app: demo-app
policyTypes: [Ingress, Egress]
ingress:
- ports:
- protocol: TCP
port: 8000
egress:
# DNS ke bina kuch bhi kaam nahi karega
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53

36
manifests/hello-api/networkpolicy.yaml Normal file
View File

@ -0,0 +1,36 @@
# Pehle sab band. Pod compromise ho to wo cluster me idhar-udhar na ja sake.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: hello-api
spec:
podSelector: {}
policyTypes: [Ingress, Egress]
---
# Ab sirf jo chahiye wahi khola: app port par traffic andar, DNS bahar.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-app
namespace: hello-api
spec:
podSelector:
matchLabels:
app: hello-api
policyTypes: [Ingress, Egress]
ingress:
- ports:
- protocol: TCP
port: 8000
egress:
# DNS ke bina kuch bhi kaam nahi karega
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53