mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 11:50:44 +00:00
Default deny all egress from pods in the namespace
This commit is contained in:
parent
23a46d8843
commit
189edf1e73
@ -556,6 +556,17 @@ var _ = SIGDescribeCopy("Netpol [LinuxOnly]", func() {
|
|||||||
ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability})
|
ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability})
|
||||||
})
|
})
|
||||||
|
|
||||||
|
ginkgo.It("should deny egress from all pods in a namespace [Feature:NetworkPolicy] ", func() {
|
||||||
|
nsX, _, _, model, k8s := getK8SModel(f)
|
||||||
|
policy := GetDenyEgress("deny-egress-ns-x")
|
||||||
|
CreatePolicy(k8s, policy, nsX)
|
||||||
|
|
||||||
|
reachability := NewReachability(model.AllPods(), true)
|
||||||
|
reachability.ExpectPeer(&Peer{Namespace: nsX}, &Peer{}, false)
|
||||||
|
|
||||||
|
ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability})
|
||||||
|
})
|
||||||
|
|
||||||
ginkgo.It("should work with Ingress, Egress specified together [Feature:NetworkPolicy]", func() {
|
ginkgo.It("should work with Ingress, Egress specified together [Feature:NetworkPolicy]", func() {
|
||||||
allowedPodLabels := &metav1.LabelSelector{MatchLabels: map[string]string{"pod": "b"}}
|
allowedPodLabels := &metav1.LabelSelector{MatchLabels: map[string]string{"pod": "b"}}
|
||||||
policy := GetAllowIngressByPod("allow-client-a-via-pod-selector", map[string]string{"pod": "a"}, allowedPodLabels)
|
policy := GetAllowIngressByPod("allow-client-a-via-pod-selector", map[string]string{"pod": "a"}, allowedPodLabels)
|
||||||
|
@ -40,6 +40,20 @@ func GetDenyIngress(name string) *networkingv1.NetworkPolicy {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// GetDenyEgress returns a default deny egress policy.
|
||||||
|
func GetDenyEgress(name string) *networkingv1.NetworkPolicy {
|
||||||
|
return &networkingv1.NetworkPolicy{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: name,
|
||||||
|
},
|
||||||
|
Spec: networkingv1.NetworkPolicySpec{
|
||||||
|
PodSelector: metav1.LabelSelector{},
|
||||||
|
PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress},
|
||||||
|
Egress: []networkingv1.NetworkPolicyEgressRule{},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// GetDenyEgressForTarget returns a default deny egress policy.
|
// GetDenyEgressForTarget returns a default deny egress policy.
|
||||||
func GetDenyEgressForTarget(name string, targetSelector metav1.LabelSelector) *networkingv1.NetworkPolicy {
|
func GetDenyEgressForTarget(name string, targetSelector metav1.LabelSelector) *networkingv1.NetworkPolicy {
|
||||||
return &networkingv1.NetworkPolicy{
|
return &networkingv1.NetworkPolicy{
|
||||||
|
Loading…
Reference in New Issue
Block a user