Merge pull request #32813 from tengqm/networkpolicy-example
Move NetworkPolicy into examples
This commit is contained in:
@@ -45,42 +45,7 @@ See the [NetworkPolicy](/docs/reference/generated/kubernetes-api/{{< param "vers
|
|||||||
|
|
||||||
An example NetworkPolicy might look like this:
|
An example NetworkPolicy might look like this:
|
||||||
|
|
||||||
```yaml
|
{{< codenew file="service/networking/networkpolicy.yaml" >}}
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: test-network-policy
|
|
||||||
namespace: default
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
role: db
|
|
||||||
policyTypes:
|
|
||||||
- Ingress
|
|
||||||
- Egress
|
|
||||||
ingress:
|
|
||||||
- from:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 172.17.0.0/16
|
|
||||||
except:
|
|
||||||
- 172.17.1.0/24
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
project: myproject
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
role: frontend
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 6379
|
|
||||||
egress:
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 10.0.0.0/24
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 5978
|
|
||||||
```
|
|
||||||
|
|
||||||
{{< note >}}
|
{{< note >}}
|
||||||
POSTing this to the API server for your cluster will have no effect unless your chosen networking solution supports network policy.
|
POSTing this to the API server for your cluster will have no effect unless your chosen networking solution supports network policy.
|
||||||
|
|||||||
@@ -647,6 +647,7 @@ func TestExampleObjectSchemas(t *testing.T) {
|
|||||||
"service/networking": {
|
"service/networking": {
|
||||||
"curlpod": {&apps.Deployment{}},
|
"curlpod": {&apps.Deployment{}},
|
||||||
"custom-dns": {&api.Pod{}},
|
"custom-dns": {&api.Pod{}},
|
||||||
|
"default-ingressclass": {&networking.IngressClass{}},
|
||||||
"dual-stack-default-svc": {&api.Service{}},
|
"dual-stack-default-svc": {&api.Service{}},
|
||||||
"dual-stack-ipfamilies-ipv6": {&api.Service{}},
|
"dual-stack-ipfamilies-ipv6": {&api.Service{}},
|
||||||
"dual-stack-ipv6-svc": {&api.Service{}},
|
"dual-stack-ipv6-svc": {&api.Service{}},
|
||||||
@@ -662,6 +663,7 @@ func TestExampleObjectSchemas(t *testing.T) {
|
|||||||
"name-virtual-host-ingress": {&networking.Ingress{}},
|
"name-virtual-host-ingress": {&networking.Ingress{}},
|
||||||
"name-virtual-host-ingress-no-third-host": {&networking.Ingress{}},
|
"name-virtual-host-ingress-no-third-host": {&networking.Ingress{}},
|
||||||
"namespaced-params": {&networking.IngressClass{}},
|
"namespaced-params": {&networking.IngressClass{}},
|
||||||
|
"networkpolicy": {&networking.NetworkPolicy{}},
|
||||||
"network-policy-allow-all-egress": {&networking.NetworkPolicy{}},
|
"network-policy-allow-all-egress": {&networking.NetworkPolicy{}},
|
||||||
"network-policy-allow-all-ingress": {&networking.NetworkPolicy{}},
|
"network-policy-allow-all-ingress": {&networking.NetworkPolicy{}},
|
||||||
"network-policy-default-deny-egress": {&networking.NetworkPolicy{}},
|
"network-policy-default-deny-egress": {&networking.NetworkPolicy{}},
|
||||||
|
|||||||
@@ -0,0 +1,35 @@
|
|||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: test-network-policy
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
role: db
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 172.17.0.0/16
|
||||||
|
except:
|
||||||
|
- 172.17.1.0/24
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
project: myproject
|
||||||
|
- podSelector:
|
||||||
|
matchLabels:
|
||||||
|
role: frontend
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 6379
|
||||||
|
egress:
|
||||||
|
- to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 10.0.0.0/24
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 5978
|
||||||
|
|
||||||
Reference in New Issue
Block a user