Extends changes for GH#1096

tigera · Nov 22, 2023 · 8fa9861 · 8fa9861
1 parent daa0c79
commit 8fa9861
Show file tree

Hide file tree

Showing 22 changed files with 132 additions and 0 deletions.
diff --git a/calico-cloud/network-policy/beginners/kubernetes-default-deny.mdx b/calico-cloud/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-cloud/network-policy/default-deny.mdx b/calico-cloud/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/calico-cloud/tutorials/enterprise-security/default-deny.mdx b/calico-cloud/tutorials/enterprise-security/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/..._versioned_docs/version-18/network-policy/beginners/kubernetes-default-deny.mdx b/..._versioned_docs/version-18/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-cloud_versioned_docs/version-18/network-policy/default-deny.mdx b/calico-cloud_versioned_docs/version-18/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...-cloud_versioned_docs/version-18/tutorials/enterprise-security/default-deny.mdx b/...-cloud_versioned_docs/version-18/tutorials/enterprise-security/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx b/...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-cloud_versioned_docs/version-3.17/network-policy/default-deny.mdx b/calico-cloud_versioned_docs/version-3.17/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...loud_versioned_docs/version-3.17/tutorials/enterprise-security/default-deny.mdx b/...loud_versioned_docs/version-3.17/tutorials/enterprise-security/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/calico-enterprise/network-policy/beginners/kubernetes-default-deny.mdx b/calico-enterprise/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-enterprise/network-policy/default-deny.mdx b/calico-enterprise/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...ersioned_docs/version-3.15/network-policy/beginners/kubernetes-default-deny.mdx b/...ersioned_docs/version-3.15/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-enterprise_versioned_docs/version-3.15/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.15/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...ersioned_docs/version-3.16/network-policy/beginners/kubernetes-default-deny.mdx b/...ersioned_docs/version-3.16/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-enterprise_versioned_docs/version-3.16/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.16/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx b/...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-enterprise_versioned_docs/version-3.17/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.17/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...ersioned_docs/version-3.18/network-policy/beginners/kubernetes-default-deny.mdx b/...ersioned_docs/version-3.18/network-policy/beginners/kubernetes-default-deny.mdx
@@ -91,6 +91,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/calico-enterprise_versioned_docs/version-3.18/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.18/network-policy/default-deny.mdx
@@ -42,6 +42,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 Note the following:

diff --git a/...sioned_docs/version-3.24/network-policy/get-started/kubernetes-default-deny.mdx b/...sioned_docs/version-3.24/network-policy/get-started/kubernetes-default-deny.mdx
@@ -95,6 +95,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/...sioned_docs/version-3.25/network-policy/get-started/kubernetes-default-deny.mdx b/...sioned_docs/version-3.25/network-policy/get-started/kubernetes-default-deny.mdx
@@ -95,6 +95,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.

diff --git a/...sioned_docs/version-3.26/network-policy/get-started/kubernetes-default-deny.mdx b/...sioned_docs/version-3.26/network-policy/get-started/kubernetes-default-deny.mdx
@@ -95,6 +95,12 @@ spec:
       selector: 'k8s-app == "kube-dns"'
       ports:
       - 53
+  - action: Allow
+    protocol: TCP
+    destination:
+      selector: 'k8s-app == "kube-dns"'
+      ports:
+      - 53
 ```
 
 It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.