Graham McIntire
2e101870d7
- Remove url/live_view from config/config.exs (prevents dev config from baking into releases) - Move url/live_view to config/dev.exs and config/test.exs - Add validate_compile_env: false to release config in mix.exs - Fix egress network policy to allow DB at 10.0.19.30:6432 (PgBouncer) - Add RELEASE_VALIDATE_COMPILE_ENV to init container env
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: aprs-allow-egress
|
|
namespace: aprs
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: aprs
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# DNS resolution
|
|
- to:
|
|
- namespaceSelector: {}
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# APRS-IS upstream servers (TCP 10152 to any IP)
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
ports:
|
|
- port: 10152
|
|
protocol: TCP
|
|
# HTTPS outbound (external APIs, package fetches)
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
# Database egress (PgBouncer + direct PostgreSQL)
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 10.0.19.30/32
|
|
ports:
|
|
- port: 6432
|
|
protocol: TCP
|
|
- port: 5432
|
|
protocol: TCP
|