Giters

tnozicka / openshift-acme

ACME Controller for OpenShift and Kubernetes Cluster. (Supports e.g. Let's Encrypt)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add support for NetworkPolicy

gysel opened this issue · comments

commented

I'd like to use a NetworkPolicy to restrict access from the default namespace into my project's namespace.

I use the following policy to allow the Router to send traffic to a set of pods:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: openshift-router-nginx
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: default
  podSelector:
    matchLabels:
      component: nginx
  policyTypes:
  - Ingress

Unfortunately the exposer pods in the projects namespace to not contain labels I can use to set up a NetworkPolicy. The only option I have is to allow traffic to all pods from the default namespace.

Labels:             app=exposer-6kro17vt8umfvlbh0huarjn5a5q341g2epo70mj4m6nh1oqtlh10

I would suggest to add a new label component=acme (or similar) to allow the definition of a NetworkPolicy like the following.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: openshift-router-acme
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: default
  podSelector:
    matchLabels:
      component: acme
  policyTypes:
  - Ingress

@tnozicka

commented

PR #125 would solve it as well, but unfortunately it has not been merged.

commented

Yes, i've created this branch, with this little changes. I don't know why it has not been merged...

commented

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

commented

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

commented

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

commented

@openshift-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

commented

/reopen.