README
¶
polizei
A small HTTP service that maintains an IP blocklist in Redis and mirrors it into a Cilium clusterwide network policy (CCNP), blocking incoming traffic from the listed CIDRs.
How it works
- The blocklist lives in a Redis set (key
polizei:<suffix>) as the source of truth. POST/DELETEon/blockadd or remove a CIDR;GETon/blocklists it.- Every change is immediately written to the Cilium policy named by
NETPOL_NAME(only theingressDeny.fromCIDRfield is touched, so settings likeenableDefaultDenyare preserved). - A periodic reconciler (default every 30s) re-applies the Redis state to the policy, so it self-heals after Cilium or Kubernetes API outages.
Configuration
All flags can be set via environment variables.
| Flag | Env var | Default | Description |
|---|---|---|---|
--bind-addr |
BIND_ADDR |
0.0.0.0 |
Address to bind to |
--bind-port |
BIND_PORT |
8080 |
Port to bind to |
--log-level |
LOG_LEVEL |
info |
Log level (debug, info, warn, error) |
--redis-addr |
REDIS_ADDR |
localhost:6379 |
Redis address |
--redis-pwd |
REDIS_PWD |
(empty) | Redis password |
--kubeconfig |
KUBECONFIG |
(empty) | Path to a kubeconfig; empty uses the in-cluster config |
--redis-suffix |
REDIS_SUFFIX |
default |
Redis key suffix, e.g. to separate namespaces |
--netpol-name |
NETPOL_NAME |
(empty) | Name of the Cilium clusterwide network policy to update |
--sync-interval |
SYNC_INTERVAL |
30s |
Periodic reconcile interval; 0 disables the periodic sync |
API
| Method | Path | Description |
|---|---|---|
GET |
/ |
Liveness check |
GET |
/block |
List blocked CIDRs |
POST |
/block |
Block a CIDR: {"cidr": "10.0.0.0/8"} |
DELETE |
/block |
Unblock a CIDR: {"cidr": "10.0.0.0/8"} |
Deployment
The Helm chart lives in homeinfra.
Documentation
¶
There is no documentation for this package.
Source Files
Click to show internal directories.
Click to hide internal directories.