Split runner NetworkPolicy into namespace baseline and per-scale-set egress

2026-11-10 22:49:06 +11:00
parent c75ed6497f
commit dce2767059
2 changed files with 56 additions and 33 deletions
@@ -0,0 +1,45 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-iuclabs-k8s
+  namespace: iuclabs-runners
+spec:
+  podSelector:
+    matchLabels:
+      runners.unkin.net/scale-set: iuclabs-k8s
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 198.18.0.0/15
+              - 0.0.0.0/8
+              - 100.64.0.0/10
+              - 127.0.0.0/8
+              - 169.254.0.0/16
+              - 224.0.0.0/4
+              - 240.0.0.0/4
+      ports:
+        - protocol: TCP
+          port: 443
+    # vault.service.consul servers, from `dig vault.service.consul`
+    - to:
+        - ipBlock:
+            cidr: 198.18.25.78/32
+        - ipBlock:
+            cidr: 198.18.26.197/32
+        - ipBlock:
+            cidr: 198.18.27.116/32
+        - ipBlock:
+            cidr: 198.18.28.248/32
+        - ipBlock:
+            cidr: 198.18.29.92/32
+      ports:
+        - protocol: TCP
+          port: 8200
@@ -2,13 +2,23 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: runners
+  name: default-deny
  namespace: iuclabs-runners
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+  namespace: iuclabs-runners
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
  egress:
    - to:
        - namespaceSelector:
@@ -22,35 +32,3 @@ spec:
          port: 53
        - protocol: TCP
          port: 53
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-              - 198.18.0.0/15
-              - 0.0.0.0/8
-              - 100.64.0.0/10
-              - 127.0.0.0/8
-              - 169.254.0.0/16
-              - 224.0.0.0/4
-              - 240.0.0.0/4
-      ports:
-        - protocol: TCP
-          port: 443
-    # vault.service.consul servers, from `dig vault.service.consul`
-    - to:
-        - ipBlock:
-            cidr: 198.18.25.78/32
-        - ipBlock:
-            cidr: 198.18.26.197/32
-        - ipBlock:
-            cidr: 198.18.27.116/32
-        - ipBlock:
-            cidr: 198.18.28.248/32
-        - ipBlock:
-            cidr: 198.18.29.92/32
-      ports:
-        - protocol: TCP
-          port: 8200