23 lines
682 B
YAML
23 lines
682 B
YAML
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
# TODO: this should be a default deny rule once the istio stuff works
|
|
name: default-allow-all
|
|
spec:
|
|
endpointSelector: {} # Empty selector matches ALL endpoints
|
|
ingress:
|
|
- fromEntities:
|
|
#- "host" # Allow kubelet probes from the local node
|
|
- "all"
|
|
egress:
|
|
- toEntities:
|
|
#- "kube-apiserver" # Allow API server access
|
|
- "all"
|
|
# - toEndpoints:
|
|
# - matchLabels:
|
|
# "k8s:io.kubernetes.pod.namespace": kube-system
|
|
# k8s-app: kube-dns
|
|
# toPorts:
|
|
# - ports:
|
|
# - port: "53"
|
|
# protocol: UDP |