108 lines
2.3 KiB
YAML
108 lines
2.3 KiB
YAML
# Minimal ingress policy for a home cluster. Default-deny within the
|
|
# namespace, then allow:
|
|
# - Web traffic to hot pods on :5000 (cloudflared ingress)
|
|
# - Prometheus scrape traffic on :5000 (prop metrics) and :9100 (Rust workers)
|
|
# - Erlang distribution (EPMD + ephemeral ports) between prop + backfill pods
|
|
#
|
|
# Egress is unrestricted — pods need to reach Postgres, NFS (10.0.19.103),
|
|
# HRRR (skippy + NOAA S3), and IEM.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: prop-allow-web
|
|
namespace: prop
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: prop
|
|
tier: hot
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
# Web traffic from cloudflared (any source, port :5000).
|
|
- from: []
|
|
ports:
|
|
- port: 5000
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: prop-allow-metrics
|
|
namespace: prop
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: prop
|
|
tier: hot
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
# Prometheus scrape via apiserver proxy or NodePort.
|
|
- from:
|
|
- namespaceSelector: {} # any namespace
|
|
ports:
|
|
- port: 5000
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: grid-rs-allow-metrics
|
|
namespace: prop
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: prop-grid-rs
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- port: 9100
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: hrrr-point-allow-metrics
|
|
namespace: prop
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: hrrr-point-rs
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- port: 9100
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: prop-allow-epmd
|
|
namespace: prop
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: prop
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
# Erlang distribution within the cluster (libcluster). EPMD listens on
|
|
# 4369; actual distribution uses ephemeral ports negotiated via EPMD.
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: prop
|
|
ports:
|
|
- port: 4369
|
|
protocol: TCP
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: prop
|