Skip to content

Commit 7f5102e

Browse files
juzhaojuzhao
committed
add networkpolicy files back
1 parent 02c48aa commit 7f5102e

File tree

12 files changed

+287
-0
lines changed

12 files changed

+287
-0
lines changed

‎assets/admission-webhook/networkpolicy.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: prometheus-operator-admission-webhook-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: prometheus-operator-admission-webhook
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 8443
21+
protocol: TCP
22+
egress:
23+
- {}

‎assets/alertmanager/networkpolicy.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: alertmanager-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: alertmanager
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 9092
21+
protocol: TCP
22+
- port: 9094
23+
protocol: TCP
24+
- port: 9094
25+
protocol: UDP
26+
- port: 9095
27+
protocol: TCP
28+
- port: 9097
29+
protocol: TCP
30+
egress:
31+
- {}

‎assets/cluster-monitoring-operator/cluster-monitoring-operator-networkpolicy.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: cluster-monitoring-operator-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: cluster-monitoring-operator
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 8443
21+
protocol: TCP
22+
egress:
23+
- {}

‎assets/cluster-monitoring-operator/default-deny-networkpolicy.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: default-deny
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector: {}
13+
policyTypes:
14+
- Ingress
15+
- Egress

‎assets/kube-state-metrics/networkpolicy.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: kube-state-metrics-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: kube-state-metrics
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 8443
21+
protocol: TCP
22+
- port: 9443
23+
protocol: TCP
24+
egress:
25+
- {}

‎assets/metrics-server/networkpolicy.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: metrics-server-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: metrics-server
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 10250
21+
protocol: TCP
22+
egress:

‎assets/monitoring-plugin/networkpolicy.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: monitoring-plugin-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: monitoring-plugin
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 9443
21+
protocol: TCP
22+
egress:
23+
- {}

‎assets/openshift-state-metrics/networkpolicy.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: openshift-state-metrics-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: openshift-state-metrics
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 8443
21+
protocol: TCP
22+
- port: 9443
23+
protocol: TCP
24+
egress:
25+
- {}

‎assets/prometheus-k8s/networkpolicy.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: prometheus-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: prometheus
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
- ports:
20+
- port: 9091
21+
protocol: TCP
22+
- port: 9092
23+
protocol: TCP
24+
- port: 10901
25+
protocol: TCP
26+
- port: 10903
27+
protocol: TCP
28+
egress:
29+
- {}

‎assets/prometheus-operator/networkpolicy.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/hypershift: "true"
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
name: prometheus-operator-access
10+
namespace: openshift-monitoring
11+
spec:
12+
podSelector:
13+
matchLabels:
14+
app.kubernetes.io/name: prometheus-operator
15+
policyTypes:
16+
- Ingress
17+
- Egress
18+
ingress:
19+
# Allow access to port 8443
20+
- ports:
21+
- port: 8443
22+
protocol: TCP
23+
egress:
24+
- {}

0 commit comments

Comments
 (0)