-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
056e73b
commit 5a2101b
Showing
7 changed files
with
80 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
--- | ||
apiVersion: template.openshift.io/v1 | ||
kind: Template | ||
labels: | ||
template: quickstart-network-security-policy | ||
metadata: | ||
name: quickstart-network-security-policy | ||
objects: | ||
- kind: NetworkPolicy | ||
apiVersion: networking.k8s.io/v1 | ||
metadata: | ||
name: deny-by-default | ||
spec: | ||
# The default posture for a security first namespace is to | ||
# deny all traffic. If not added this rule will be added | ||
# by Platform Services during environment cut-over. | ||
podSelector: {} | ||
ingress: [] | ||
- apiVersion: networking.k8s.io/v1 | ||
kind: NetworkPolicy | ||
metadata: | ||
name: allow-from-openshift-ingress | ||
spec: | ||
# This policy allows any pod with a route & service combination | ||
# to accept traffic from the OpenShift router pods. This is | ||
# required for things outside of OpenShift (like the Internet) | ||
# to reach your pods. | ||
ingress: | ||
- from: | ||
- namespaceSelector: | ||
matchLabels: | ||
network.openshift.io/policy-group: ingress | ||
podSelector: {} | ||
policyTypes: | ||
- Ingress | ||
- kind: NetworkPolicy | ||
apiVersion: networking.k8s.io/v1 | ||
metadata: | ||
name: allow-same-namespace | ||
spec: | ||
# Allow all pods within the current namespace to communicate | ||
# to one another. | ||
podSelector: | ||
ingress: | ||
- from: | ||
- podSelector: {} | ||
parameters: | ||
- name: NAMESPACE | ||
displayName: Namespace | ||
description: | | ||
The namespace this policy is being deployed to; | ||
required: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters