longhorn/examples/network-policy/webhook-network-policy.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: longhorn-conversion-webhook
  namespace: longhorn-system
spec:
  podSelector:
    matchLabels:
      app: longhorn-manager
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP
      port: 9501
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: longhorn-admission-webhook
  namespace: longhorn-system
spec:
  podSelector:
    matchLabels:
      app: longhorn-manager
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP
      port: 9502
example: add longhorn webhook server network policy yaml manifest The traffic from/to the longhorn webhook server is the kube-apiserver. The only way we could add restriction is to add the network policy of the ingress port because we can't know each Kubernetes distro default kube-apiserver Pod's label. Therefore, we can't add the label selector in the network policy rule to restrict the traffic that comes from the kube-apiserver is able to access to the longhorn webhook server. Longhorn 3513 Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com> (cherry picked from commit 769e85bc80b6351a081a79ddf83ab181cf956e23) 2022-01-12 02:15:07 +00:00			`apiVersion: networking.k8s.io/v1`
			`kind: NetworkPolicy`
			`metadata:`
example: add longhorn admission and conversion webhook servers network policy yaml manifests Signed-off-by: Derek Su <derek.su@suse.com> (cherry picked from commit 0dd86841f2a2b68f4cccd8f7acfd5e8329630d12) 2022-02-10 05:32:25 +00:00			`name: longhorn-conversion-webhook`
example: add longhorn webhook server network policy yaml manifest The traffic from/to the longhorn webhook server is the kube-apiserver. The only way we could add restriction is to add the network policy of the ingress port because we can't know each Kubernetes distro default kube-apiserver Pod's label. Therefore, we can't add the label selector in the network policy rule to restrict the traffic that comes from the kube-apiserver is able to access to the longhorn webhook server. Longhorn 3513 Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com> (cherry picked from commit 769e85bc80b6351a081a79ddf83ab181cf956e23) 2022-01-12 02:15:07 +00:00			`namespace: longhorn-system`
			`spec:`
			`podSelector:`
			`matchLabels:`
refactor (webhook and recovery service): merge webhook and recovery service into longhorn manager daemonset Ref: longhorn/longhorn5590 Signed-off-by: Jack Lin <jack.lin@suse.com> 2023-03-23 09:15:38 +00:00			`app: longhorn-manager`
example: add longhorn admission and conversion webhook servers network policy yaml manifests Signed-off-by: Derek Su <derek.su@suse.com> (cherry picked from commit 0dd86841f2a2b68f4cccd8f7acfd5e8329630d12) 2022-02-10 05:32:25 +00:00			`policyTypes:`
			`- Ingress`
			`ingress:`
			`- ports:`
			`- protocol: TCP`
refactor (webhook and recovery service): merge webhook and recovery service into longhorn manager daemonset Ref: longhorn/longhorn5590 Signed-off-by: Jack Lin <jack.lin@suse.com> 2023-03-23 09:15:38 +00:00			`port: 9501`
example: add longhorn admission and conversion webhook servers network policy yaml manifests Signed-off-by: Derek Su <derek.su@suse.com> (cherry picked from commit 0dd86841f2a2b68f4cccd8f7acfd5e8329630d12) 2022-02-10 05:32:25 +00:00			`---`
			`apiVersion: networking.k8s.io/v1`
			`kind: NetworkPolicy`
			`metadata:`
			`name: longhorn-admission-webhook`
			`namespace: longhorn-system`
			`spec:`
			`podSelector:`
			`matchLabels:`
refactor (webhook and recovery service): merge webhook and recovery service into longhorn manager daemonset Ref: longhorn/longhorn5590 Signed-off-by: Jack Lin <jack.lin@suse.com> 2023-03-23 09:15:38 +00:00			`app: longhorn-manager`
example: add longhorn webhook server network policy yaml manifest The traffic from/to the longhorn webhook server is the kube-apiserver. The only way we could add restriction is to add the network policy of the ingress port because we can't know each Kubernetes distro default kube-apiserver Pod's label. Therefore, we can't add the label selector in the network policy rule to restrict the traffic that comes from the kube-apiserver is able to access to the longhorn webhook server. Longhorn 3513 Signed-off-by: JenTing Hsiao <jenting.hsiao@suse.com> (cherry picked from commit 769e85bc80b6351a081a79ddf83ab181cf956e23) 2022-01-12 02:15:07 +00:00			`policyTypes:`
			`- Ingress`
			`ingress:`
			`- ports:`
			`- protocol: TCP`
refactor (webhook and recovery service): merge webhook and recovery service into longhorn manager daemonset Ref: longhorn/longhorn5590 Signed-off-by: Jack Lin <jack.lin@suse.com> 2023-03-23 09:15:38 +00:00			`port: 9502`