-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Egress access control tutorial (#198)
Co-authored-by: Ori Shoshan <[email protected]>
- Loading branch information
1 parent
9380506
commit be5a8fb
Showing
14 changed files
with
524 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
316 changes: 316 additions & 0 deletions
316
...twork-mapping-network-policies/tutorials/k8s-egress-access-control-tutorial.mdx
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,57 @@ | ||
apiVersion: v1 | ||
kind: Namespace | ||
metadata: | ||
name: otterize-tutorial-egress-access | ||
--- | ||
apiVersion: apps/v1 | ||
kind: Deployment | ||
metadata: | ||
name: frontend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
selector: | ||
matchLabels: | ||
app: frontend | ||
template: | ||
metadata: | ||
labels: | ||
app: frontend | ||
spec: | ||
containers: | ||
- name: frontend | ||
imagePullPolicy: Always | ||
image: 'otterize/egress-tutorial-frontend' | ||
--- | ||
apiVersion: apps/v1 | ||
kind: Deployment | ||
metadata: | ||
name: backend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
selector: | ||
matchLabels: | ||
app: backend | ||
template: | ||
metadata: | ||
labels: | ||
app: backend | ||
spec: | ||
containers: | ||
- name: backend | ||
imagePullPolicy: Always | ||
image: 'otterize/egress-tutorial-backend' | ||
ports: | ||
- containerPort: 8080 | ||
--- | ||
apiVersion: v1 | ||
kind: Service | ||
metadata: | ||
name: backend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
selector: | ||
app: backend | ||
ports: | ||
- protocol: TCP | ||
port: 8080 | ||
targetPort: 8080 |
14 changes: 14 additions & 0 deletions
14
static/code-examples/egress-access-control/default-deny-policy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
--- | ||
apiVersion: networking.k8s.io/v1 | ||
kind: NetworkPolicy | ||
metadata: | ||
name: default-deny | ||
spec: | ||
podSelector: {} | ||
policyTypes: | ||
- Egress | ||
- Ingress | ||
egress: | ||
- ports: | ||
- protocol: UDP | ||
port: 53 |
22 changes: 22 additions & 0 deletions
22
static/code-examples/egress-access-control/dns-enabled-npol.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
apiVersion: networking.k8s.io/v1 | ||
kind: NetworkPolicy | ||
metadata: | ||
name: allow-dns-access | ||
spec: | ||
egress: | ||
- ports: | ||
- port: 53 | ||
protocol: UDP | ||
to: | ||
- namespaceSelector: | ||
matchLabels: | ||
kubernetes.io/metadata.name: kube-system | ||
podSelector: | ||
matchLabels: | ||
k8s-app: kube-dns | ||
podSelector: | ||
matchExpressions: | ||
- key: intents.otterize.com/service | ||
operator: Exists | ||
policyTypes: | ||
- Egress |
26 changes: 26 additions & 0 deletions
26
static/code-examples/egress-access-control/domain-intents.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: frontend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: frontend | ||
calls: | ||
- name: backend | ||
--- | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: backend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: backend | ||
calls: | ||
- type: internet | ||
internet: | ||
domains: | ||
# Domain name for our advice service | ||
- api.adviceslip.com | ||
- name: frontend |
21 changes: 21 additions & 0 deletions
21
static/code-examples/egress-access-control/intents-no-external-api.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: frontend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: frontend | ||
calls: | ||
- name: backend | ||
--- | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: backend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: backend | ||
calls: | ||
- name: frontend |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: frontend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: frontend | ||
calls: | ||
- name: backend | ||
--- | ||
apiVersion: k8s.otterize.com/v1alpha3 | ||
kind: ClientIntents | ||
metadata: | ||
name: backend | ||
namespace: otterize-tutorial-egress-access | ||
spec: | ||
service: | ||
name: backend | ||
calls: | ||
- type: internet | ||
internet: | ||
ips: | ||
- 185.53.57.80 # IP address of our external aPI | ||
- name: frontend |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added
BIN
+135 KB
static/img/quick-tutorials/egress-access-control/cluster-intents-applied.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added
BIN
+74.2 KB
...g/quick-tutorials/egress-access-control/unprotected-network-egress-tutorial.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters