Skip to content

Commit

Permalink
Extends changes for GH#1096
Browse files Browse the repository at this point in the history
  • Loading branch information
@ctauchen
ctauchen committed Nov 21, 2023
1 parent 71a1dd2 commit d58ee93
Show file tree
Hide file tree
Showing 23 changed files with 144 additions and 0 deletions.
6 changes: 6 additions & 0 deletions calico-cloud/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-cloud/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
12 changes: 12 additions & 0 deletions calico-cloud/tutorials/enterprise-security/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,18 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ..._versioned_docs/version-18/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-cloud_versioned_docs/version-18/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...-cloud_versioned_docs/version-18/tutorials/enterprise-security/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-cloud_versioned_docs/version-3.17/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...loud_versioned_docs/version-3.17/tutorials/enterprise-security/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...ersioned_docs/version-3.15/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise_versioned_docs/version-3.15/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...ersioned_docs/version-3.16/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise_versioned_docs/version-3.16/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...ersioned_docs/version-3.17/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise_versioned_docs/version-3.17/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions ...ersioned_docs/version-3.18/network-policy/beginners/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/component-resources/node/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions calico-enterprise_versioned_docs/version-3.18/network-policy/default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
Note the following:
Expand Down
6 changes: 6 additions & 0 deletions calico/network-policy/get-started/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions ...sioned_docs/version-3.24/network-policy/get-started/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions ...sioned_docs/version-3.25/network-policy/get-started/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down
6 changes: 6 additions & 0 deletions ...sioned_docs/version-3.26/network-policy/get-started/kubernetes-default-deny.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,12 @@ spec:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
- action: Allow
protocol: TCP
destination:
selector: 'k8s-app == "kube-dns"'
ports:
- 53
```
It is important to note the above policy deliberately excludes the `kube-system`, `calico-system` and `calico-apiserver` namespaces by using a negative `namespaceSelector` to avoid impacting any control plane components. To secure the control plane you can write specific policies for each control plane component, though you should do so with care, ideally at cluster creation time, since getting these wrong can leave your cluster in a broken state. We recommend you always make sure you have the correct {{prodname}} [failsafe ports](../../reference/felix/configuration.mdx) in place before you start trying to create policies for the control plane.
Expand Down

0 comments on commit d58ee93

Please sign in to comment.