feat: added example for network policies

vicenteherrera · Jun 16, 2023 · 9e248d4 · 9e248d4
1 parent 8771e6e
commit 9e248d4
Show file tree

Hide file tree

Showing 6 changed files with 112 additions and 0 deletions.
diff --git a/exercises/network_policies/calico/allow-tcp-6379.yaml b/exercises/network_policies/calico/allow-tcp-6379.yaml
@@ -0,0 +1,24 @@
+apiVersion: projectcalico.org/v3
+kind: GlobalNetworkPolicy
+metadata:
+  name: allow-nginx-only
+spec:
+  selector: app == 'nginx'
+  types:
+    - Ingress
+    - Egress
+  ingress:
+    - action: Allow
+      metadata:
+        annotations:
+          from: frontend
+          to: database
+      protocol: TCP
+      source:
+        selector: role == 'frontend'
+      destination:
+        ports:
+          - 80
+          - 443
+  egress:
+    - action: Allow
diff --git a/exercises/network_policies/calico/deny-kubelet-port.yaml b/exercises/network_policies/calico/deny-kubelet-port.yaml
@@ -0,0 +1,16 @@
+apiVersion: crd.projectcalico.org/v1
+kind: GlobalNetworkPolicy
+metadata:
+    name: deny-kubelet-prot
+spec:
+    types:
+    - Egress
+    egress:
+    - action: Deny
+      protocol: TCP
+      destination:
+        nets:
+        - 0.0.0.0/0
+        ports:
+        - 10250
+    source: {}
diff --git a/exercises/network_policies/dep-nginx.yaml b/exercises/network_policies/dep-nginx.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - image: nginx
+        name: nginx
+        resources: {}
+status: {}
diff --git a/exercises/network_policies/makefile b/exercises/network_policies/makefile
@@ -0,0 +1,19 @@
+create_nginx:
+	kubectl create deployment nginx --image=nginx
+
+expose_nginx:
+	kubectl expose deployment nginx --port=80
+
+test_connection:
+	@@echo "To test connection, run in the container:"
+	@@echo "wget --spider --timeout=1 nginx"
+	kubectl run busybox --rm -ti --image=busybox:1.28 -- /bin/sh
+
+apply_kpn:
+	kubectl apply -f https://k8s.io/examples/service/networking/nginx-policy.yaml
+
+apply_calico:
+	calicoctl create --filename=./calico/allow-tcp-6379.yaml
+
+delete_calico:
+	calicoctl delete --filename=./calico/allow-tcp-6379.yaml
diff --git a/exercises/network_policies/nginx-policy.yaml b/exercises/network_policies/nginx-policy.yaml
@@ -0,0 +1,13 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: access-nginx
+spec:
+  podSelector:
+    matchLabels:
+      app: nginx
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          access: "true"
diff --git a/exercises/network_policies/svc-nginx.yaml b/exercises/network_policies/svc-nginx.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    app: nginx
+  name: nginx
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: nginx
+status:
+  loadBalancer: {}