Documentation
¶
Index ¶
- func APIServerEgressRule() networkingv1.NetworkPolicyEgressRule
- func DNSEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule
- func DefaultDenyPolicy(name string, podSelector metav1.LabelSelector) networkingv1.NetworkPolicy
- func EgressToAll() networkingv1.NetworkPolicyEgressRule
- func Generate(cfg v1alpha1.NetworkPolicyConfig, ns string, ...) (mf.Manifest, error)
- func InternetEgressRule() networkingv1.NetworkPolicyEgressRule
- func PrometheusIngressRule(p PlatformParams, port intstr.IntOrString) networkingv1.NetworkPolicyIngressRule
- func SSHEgressRule() networkingv1.NetworkPolicyEgressRule
- func WebhookIngressRule(cidr string, port intstr.IntOrString) networkingv1.NetworkPolicyIngressRule
- type PlatformParams
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func APIServerEgressRule ¶
func APIServerEgressRule() networkingv1.NetworkPolicyEgressRule
APIServerEgressRule allows all egress so pods can reach the API server. NetworkPolicy cannot select host-network endpoints, and the API server port is configurable, so we must allow unrestricted egress.
func DNSEgressRule ¶
func DNSEgressRule(p PlatformParams) networkingv1.NetworkPolicyEgressRule
DNSEgressRule allows egress to DNS resolver pods on UDP and TCP using the platform-specific DNS port (53 on Kubernetes, 5353 on OpenShift).
func DefaultDenyPolicy ¶
func DefaultDenyPolicy(name string, podSelector metav1.LabelSelector) networkingv1.NetworkPolicy
DefaultDenyPolicy returns a default-deny NetworkPolicy scoped to podSelector. Use an empty LabelSelector{} for a namespace-wide deny once all components support NetworkPolicy.
func EgressToAll ¶
func EgressToAll() networkingv1.NetworkPolicyEgressRule
EgressToAll returns an unrestricted egress rule (empty rule = allow all).
func Generate ¶
func Generate( cfg v1alpha1.NetworkPolicyConfig, ns string, defaults []networkingv1.NetworkPolicy, ) (mf.Manifest, error)
Generate builds a Manifest by merging defaults with cfg.Policies.
- Returns an empty manifest when cfg.Disabled is true.
- Starts with defaults keyed by name; cfg.Policies entries overwrite on collision and add when new.
- Injects namespace into every NetworkPolicy object.
- Output is sorted by name for deterministic InstallerSet checksums.
func InternetEgressRule ¶
func InternetEgressRule() networkingv1.NetworkPolicyEgressRule
InternetEgressRule allows egress on TCP 80 and 443 to any destination.
func PrometheusIngressRule ¶
func PrometheusIngressRule(p PlatformParams, port intstr.IntOrString) networkingv1.NetworkPolicyIngressRule
PrometheusIngressRule allows ingress from the monitoring namespace on the given port.
func SSHEgressRule ¶
func SSHEgressRule() networkingv1.NetworkPolicyEgressRule
SSHEgressRule allows TCP egress on port 22 for git clone over SSH.
func WebhookIngressRule ¶
func WebhookIngressRule(cidr string, port intstr.IntOrString) networkingv1.NetworkPolicyIngressRule
WebhookIngressRule allows ingress on port for admission webhooks. If cidr is empty, allows from any source (no From restriction).
Types ¶
type PlatformParams ¶
type PlatformParams struct {
DNSResolverNamespace string
DNSResolverPodLabel map[string]string
PrometheusNamespaceLabel map[string]string
// DNSPort is the DNS resolver pod port. Kubernetes CoreDNS uses 53; OpenShift DNS
// uses 5353 (OVN-K8s enforces NetworkPolicy after DNAT, so pod port applies).
DNSPort int32
}
PlatformParams holds platform-specific values for building default NetworkPolicy rules. It is an internal type — it never appears in CRD API fields.
func KubernetesPlatformDefaults ¶
func KubernetesPlatformDefaults() PlatformParams
KubernetesPlatformDefaults returns PlatformParams for vanilla Kubernetes.
func OpenShiftPlatformDefaults ¶
func OpenShiftPlatformDefaults() PlatformParams
OpenShiftPlatformDefaults returns PlatformParams for OpenShift.
Source Files