init

network-policy/web-client/0-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: isolated

network-policy/web-client/1-pods.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: web
+  namespace: isolated
+  labels:
+    app: web
+spec:
+  containers:
+    - name: web
+      image: ghcr.io/trion-development/echoserver:1
+      ports:
+        - containerPort: 3000
+      resources: {}
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: client
+  namespace: isolated
+  labels:
+    app: client
+spec:
+  containers:
+    - name: curl
+      image: trion/curl:1
+      tty: true
+      resources: {}

network-policy/web-client/2-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: web
+  namespace: isolated
+spec:
+  selector:
+    app: web
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 3000

network-policy/web-client/3-deny-all.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deny-all-ingress
+  namespace: isolated
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deny-all-egress
+  namespace: isolated
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress

network-policy/web-client/4-allow-http.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-client-to-web
+  namespace: isolated
+spec:
+  podSelector:
+    matchLabels:
+      app: web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: client
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 3000

network-policy/web-client/5-allow-dns.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns-client
+  namespace: isolated
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+  - to:
+    - namespaceSelector:
+       matchLabels:
+         kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+    ports:
+    - protocol: UDP
+      port: 53

network-policy/web-client/6-allow-extern.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-client-egress-internet
+  namespace: isolated
+spec:
+  podSelector:
+    matchLabels:
+      app: client
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443

network-policy/web-client/commands

@@ -0,0 +1,2 @@
+kubectl -n isolated get pods -o wide
+