BrunoGao
9d331f95c2
* feat(ljwx-health): add isolated schema restore drill foundation * fix(ljwx-health): verify Cosign v3 custom bindings * test(ljwx-health): cover production binding envelope * fix(ljwx-health): isolate restore drill API token * fix(ljwx-health): split restore drill cross-namespace RBAC * fix(ljwx-health): annotate trap-only cleanup
59 lines
1.3 KiB
YAML
59 lines
1.3 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: ljwx-health-schema-restore-drill
|
|
namespace: ljwx-health
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-2"
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: schema-restore-drill
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.43.0.1/32
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: infra
|
|
podSelector:
|
|
matchLabels:
|
|
app: minio
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9000
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 127.0.0.0/8
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 224.0.0.0/4
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|