34 lines
1.0 KiB
YAML
34 lines
1.0 KiB
YAML
# CiliumNetworkPolicy — restrict who may reach Vault HTTP listener (8200).
|
|
# Apply after Cilium is healthy: kubectl apply -f clusters/noble/apps/vault/cilium-network-policy.yaml
|
|
#
|
|
# Ingress-only policy: egress from Vault is unchanged (Kubernetes auth needs API + DNS).
|
|
# Extend ingress rules if other namespaces must call Vault (e.g. app workloads).
|
|
#
|
|
# Ref: https://docs.cilium.io/en/stable/security/policy/language/
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: vault-http-ingress
|
|
namespace: vault
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: vault
|
|
component: server
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": external-secrets
|
|
toPorts:
|
|
- ports:
|
|
- port: "8200"
|
|
protocol: TCP
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": vault
|
|
toPorts:
|
|
- ports:
|
|
- port: "8200"
|
|
protocol: TCP
|