You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/security/hardening-guide.md
+1-58Lines changed: 1 addition & 58 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -405,11 +405,7 @@ spec:
405
405
- Ingress
406
406
```
407
407
408
-
The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2. Ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster.
409
-
410
-
<Tabs>
411
-
<TabItem value="v1.21 and Newer" default>
412
-
408
+
The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Ensure that you use the sample yaml below:
413
409
```yaml
414
410
apiVersion: networking.k8s.io/v1
415
411
kind: NetworkPolicy
@@ -452,60 +448,7 @@ spec:
452
448
- {}
453
449
policyTypes:
454
450
- Ingress
455
-
---
456
-
457
451
```
458
-
</TabItem>
459
-
460
-
<TabItem value="v1.20 and Older" default>
461
-
462
-
```yaml
463
-
apiVersion: networking.k8s.io/v1
464
-
kind: NetworkPolicy
465
-
metadata:
466
-
name: allow-all-metrics-server
467
-
namespace: kube-system
468
-
spec:
469
-
podSelector:
470
-
matchLabels:
471
-
k8s-app: metrics-server
472
-
ingress:
473
-
- {}
474
-
policyTypes:
475
-
- Ingress
476
-
---
477
-
apiVersion: networking.k8s.io/v1
478
-
kind: NetworkPolicy
479
-
metadata:
480
-
name: allow-all-svclbtraefik-ingress
481
-
namespace: kube-system
482
-
spec:
483
-
podSelector:
484
-
matchLabels:
485
-
svccontroller.k3s.cattle.io/svcname: traefik
486
-
ingress:
487
-
- {}
488
-
policyTypes:
489
-
- Ingress
490
-
---
491
-
apiVersion: networking.k8s.io/v1
492
-
kind: NetworkPolicy
493
-
metadata:
494
-
name: allow-all-traefik-v120-ingress
495
-
namespace: kube-system
496
-
spec:
497
-
podSelector:
498
-
matchLabels:
499
-
app: traefik
500
-
ingress:
501
-
- {}
502
-
policyTypes:
503
-
- Ingress
504
-
---
505
-
506
-
```
507
-
</TabItem>
508
-
</Tabs>
509
452
510
453
:::info
511
454
Operators must manage network policies as normal for additional namespaces that are created.
0 commit comments