Skip to content

Commit c02d302

Browse files
mglotovmglotov
authored
feat: add default networkpolicies for all namespaces except istio-system and teamcity (#168)
1 parent 2186393 commit c02d302

16 files changed

+1091
-234
lines changed

‎README.md‎

Lines changed: 121 additions & 50 deletions
Large diffs are not rendered by default.

‎docs/FAQ.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ module "test_namespace" {
100100
{
101101
name = "allow-this-namespace"
102102
policy_types = ["Ingress"]
103+
pod_selector = {}
103104
ingress = {
104105
from = [
105106
{
@@ -115,6 +116,7 @@ module "test_namespace" {
115116
{
116117
name = "allow-from-ingress-namespace"
117118
policy_types = ["Ingress"]
119+
pod_selector = {}
118120
ingress = {
119121
from = [
120122
{
@@ -130,6 +132,7 @@ module "test_namespace" {
130132
{
131133
name = "allow-egress-to-dev"
132134
policy_type = ["Egress"]
135+
pod_selector = {}
133136
egress = {
134137
ports = [
135138
{

‎terraform/layer2-k8s/eks-aws-loadbalancer-controller.tf‎

Lines changed: 83 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,23 +13,77 @@ locals {
1313
})
1414
}
1515

16+
#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
1617
module "aws_load_balancer_controller_namespace" {
17-
source = "../modules/kubernetes-namespace"
18-
name = "aws-load-balancer-controller"
19-
}
20-
21-
resource "helm_release" "aws_loadbalancer_controller" {
2218
count = var.aws_loadbalancer_controller_enable ? 1 : 0
2319

24-
name = "aws-load-balancer-controller"
25-
chart = local.aws-load-balancer-controller.chart
26-
repository = local.aws-load-balancer-controller.repository
27-
version = local.aws-load-balancer-controller.chart_version
28-
namespace = module.aws_load_balancer_controller_namespace.name
29-
max_history = var.helm_release_history_size
30-
31-
values = [
32-
local.alb_ingress_controller
20+
source = "../modules/kubernetes-namespace"
21+
name = "aws-load-balancer-controller"
22+
network_policies = [
23+
{
24+
name = "default-deny"
25+
policy_types = ["Ingress", "Egress"]
26+
pod_selector = {}
27+
},
28+
{
29+
name = "allow-this-namespace"
30+
policy_types = ["Ingress"]
31+
pod_selector = {}
32+
ingress = {
33+
from = [
34+
{
35+
namespace_selector = {
36+
match_labels = {
37+
name = "aws-load-balancer-controller"
38+
}
39+
}
40+
}
41+
]
42+
}
43+
},
44+
{
45+
name = "allow-control-plane"
46+
policy_types = ["Ingress"]
47+
pod_selector = {
48+
match_expressions = {
49+
key = "app.kubernetes.io/name"
50+
operator = "In"
51+
values = ["aws-load-balancer-controller"]
52+
}
53+
}
54+
ingress = {
55+
ports = [
56+
{
57+
port = "9443"
58+
protocol = "TCP"
59+
}
60+
]
61+
from = [
62+
{
63+
ip_block = {
64+
cidr = "0.0.0.0/0"
65+
}
66+
}
67+
]
68+
}
69+
},
70+
{
71+
name = "allow-egress"
72+
policy_types = ["Egress"]
73+
pod_selector = {}
74+
egress = {
75+
to = [
76+
{
77+
ip_block = {
78+
cidr = "0.0.0.0/0"
79+
except = [
80+
"169.254.169.254/32"
81+
]
82+
}
83+
}
84+
]
85+
}
86+
}
3387
]
3488
}
3589

@@ -249,3 +303,18 @@ module "aws_iam_aws_loadbalancer_controller" {
249303
]
250304
})
251305
}
306+
307+
resource "helm_release" "aws_loadbalancer_controller" {
308+
count = var.aws_loadbalancer_controller_enable ? 1 : 0
309+
310+
name = "aws-load-balancer-controller"
311+
chart = local.aws-load-balancer-controller.chart
312+
repository = local.aws-load-balancer-controller.repository
313+
version = local.aws-load-balancer-controller.chart_version
314+
namespace = module.aws_load_balancer_controller_namespace[count.index].name
315+
max_history = var.helm_release_history_size
316+
317+
values = [
318+
local.alb_ingress_controller
319+
]
320+
}

‎terraform/layer2-k8s/eks-aws-node-termination-handler.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,50 @@ locals {
66
}
77
}
88

9+
#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
910
module "aws_node_termination_handler_namespace" {
1011
source = "../modules/kubernetes-namespace"
1112
name = "aws-node-termination-handler"
13+
network_policies = [
14+
{
15+
name = "default-deny"
16+
policy_types = ["Ingress", "Egress"]
17+
pod_selector = {}
18+
},
19+
{
20+
name = "allow-this-namespace"
21+
policy_types = ["Ingress"]
22+
pod_selector = {}
23+
ingress = {
24+
from = [
25+
{
26+
namespace_selector = {
27+
match_labels = {
28+
name = "aws-node-termination-handler"
29+
}
30+
}
31+
}
32+
]
33+
}
34+
},
35+
{
36+
name = "allow-egress"
37+
policy_types = ["Egress"]
38+
pod_selector = {}
39+
egress = {
40+
to = [
41+
{
42+
ip_block = {
43+
cidr = "0.0.0.0/0"
44+
except = [
45+
"169.254.169.254/32"
46+
]
47+
}
48+
}
49+
]
50+
}
51+
}
52+
]
1253
}
1354

1455
resource "helm_release" "aws_node_termination_handler" {

‎terraform/layer2-k8s/eks-cert-manager.tf‎

Lines changed: 81 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,76 @@ data "template_file" "cert_manager" {
1414
}
1515
}
1616

17-
resource "helm_release" "cert_manager" {
18-
name = "cert-manager"
19-
chart = local.cert-manager.chart
20-
repository = local.cert-manager.repository
21-
version = local.cert-manager.chart_version
22-
namespace = module.certmanager_namespace.name
23-
wait = true
24-
max_history = var.helm_release_history_size
25-
26-
values = [
27-
data.template_file.cert_manager.rendered,
28-
]
29-
}
30-
17+
#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
3118
module "certmanager_namespace" {
3219
source = "../modules/kubernetes-namespace"
3320
name = "certmanager"
21+
network_policies = [
22+
{
23+
name = "default-deny"
24+
policy_types = ["Ingress", "Egress"]
25+
pod_selector = {}
26+
},
27+
{
28+
name = "allow-this-namespace"
29+
policy_types = ["Ingress"]
30+
pod_selector = {}
31+
ingress = {
32+
from = [
33+
{
34+
namespace_selector = {
35+
match_labels = {
36+
name = "certmanager"
37+
}
38+
}
39+
}
40+
]
41+
}
42+
},
43+
{
44+
name = "allow-control-plane"
45+
policy_types = ["Ingress"]
46+
pod_selector = {
47+
match_expressions = {
48+
key = "app.kubernetes.io/name"
49+
operator = "In"
50+
values = ["webhook"]
51+
}
52+
}
53+
ingress = {
54+
ports = [
55+
{
56+
port = "10250"
57+
protocol = "TCP"
58+
}
59+
]
60+
from = [
61+
{
62+
ip_block = {
63+
cidr = "0.0.0.0/0"
64+
}
65+
}
66+
]
67+
}
68+
},
69+
{
70+
name = "allow-egress"
71+
policy_types = ["Egress"]
72+
pod_selector = {}
73+
egress = {
74+
to = [
75+
{
76+
ip_block = {
77+
cidr = "0.0.0.0/0"
78+
except = [
79+
"169.254.169.254/32"
80+
]
81+
}
82+
}
83+
]
84+
}
85+
}
86+
]
3487
}
3588

3689
#tfsec:ignore:aws-iam-no-policy-wildcards
@@ -73,3 +126,17 @@ module "aws_iam_cert_manager" {
73126
]
74127
})
75128
}
129+
130+
resource "helm_release" "cert_manager" {
131+
name = "cert-manager"
132+
chart = local.cert-manager.chart
133+
repository = local.cert-manager.repository
134+
version = local.cert-manager.chart_version
135+
namespace = module.certmanager_namespace.name
136+
wait = true
137+
max_history = var.helm_release_history_size
138+
139+
values = [
140+
data.template_file.cert_manager.rendered,
141+
]
142+
}

0 commit comments

Comments
 (0)