whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update network-policy by adding egress and ipBlock usage (#5473)

Browse Source
This commit is contained in:
Lion-Wei
2017-09-25 11:22:16 +08:00
committed by Zach Corleissen
parent 7bffd97b9a
commit b23b91a3ab
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/services-networking/network-policies.md
+9
View File
@@ -41,6 +41,10 @@ spec:
role: db role: db
ingress: ingress:
- from: - from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector: - namespaceSelector:
matchLabels: matchLabels:
project: myproject project: myproject
@@ -62,6 +66,11 @@ __podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the
__ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. The example policy contains a single rule, which matches traffic on a single port, from either of two sources, the first specified via a `namespaceSelector` and the second specified via a `podSelector`. __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. The example policy contains a single rule, which matches traffic on a single port, from either of two sources, the first specified via a `namespaceSelector` and the second specified via a `podSelector`.
__ipBlock__: `ipBlock` describes a particular CIDR that is allowed to
the pods matched by a NetworkPolicySpec's podSelector. The `except` entry
is a slice of CIDRs that should not be included within an IP Block. Except
values will be rejected if they are outside the CIDR range.
So, the example NetworkPolicy: So, the example NetworkPolicy:
1. isolates "role=db" pods in the "default" namespace (if they weren't already isolated) 1. isolates "role=db" pods in the "default" namespace (if they weren't already isolated)