39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
|
# Network Policies
|
||
|
|
|
||
|
|
Network policies restrict traffic between pods for defense in depth.
|
||
|
|
|
||
|
|
## Dependencies
|
||
|
|
|
||
|
|
| Service | Ingress From | Egress To |
|
||
|
|
|---------------|-------------------|------------------------------|
|
||
|
|
| backend-api | ingress-nginx | PostgreSQL (5432), Redis (6379), DNS |
|
||
|
|
| frontend | ingress-nginx | - |
|
||
|
|
| chat-server | ingress-nginx | PostgreSQL (5432), Redis (6379), DNS |
|
||
|
|
| stream-server | ingress-nginx | Redis, storage |
|
||
|
|
|
||
|
|
## Usage
|
||
|
|
|
||
|
|
1. Apply default deny first:
|
||
|
|
```bash
|
||
|
|
kubectl apply -f k8s/network-policies/default-deny.yaml
|
||
|
|
```
|
||
|
|
|
||
|
|
2. Apply allow policies for each component:
|
||
|
|
```bash
|
||
|
|
kubectl apply -f k8s/network-policies/backend-api-allow.yaml
|
||
|
|
kubectl apply -f k8s/network-policies/frontend-allow.yaml
|
||
|
|
kubectl apply -f k8s/network-policies/chat-server-allow.yaml
|
||
|
|
```
|
||
|
|
|
||
|
|
## Ingress Controller
|
||
|
|
|
||
|
|
Policies reference `namespaceSelector.matchLabels.name: ingress-nginx`. Ensure your ingress controller namespace has this label:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
kubectl label namespace ingress-nginx name=ingress-nginx
|
||
|
|
```
|
||
|
|
|
||
|
|
## External Services
|
||
|
|
|
||
|
|
If PostgreSQL or Redis run outside the cluster, the egress `ipBlock.cidr: 0.0.0.0/0` allows connections. For stricter policies, replace with specific CIDRs.
|