Harden GX10 Intranet pod boundary

2026-06-21 03:32:12 -05:00
parent e41c9f4ae7
commit 5e56dcb59c
4 changed files with 122 additions and 1 deletions
--- a/apps-gx10/intranet/networkpolicy-intranet-web.json
+++ b/apps-gx10/intranet/networkpolicy-intranet-web.json
@@ -0,0 +1,91 @@
+{
+  "apiVersion": "networking.k8s.io/v1",
+  "kind": "NetworkPolicy",
+  "metadata": {
+    "name": "intranet-web",
+    "namespace": "intranet"
+  },
+  "spec": {
+    "egress": [
+      {
+        "ports": [
+          {
+            "port": 53,
+            "protocol": "UDP"
+          },
+          {
+            "port": 53,
+            "protocol": "TCP"
+          }
+        ],
+        "to": [
+          {
+            "namespaceSelector": {
+              "matchLabels": {
+                "kubernetes.io/metadata.name": "kube-system"
+              }
+            }
+          }
+        ]
+      },
+      {
+        "ports": [
+          {
+            "port": 443,
+            "protocol": "TCP"
+          }
+        ],
+        "to": [
+          {
+            "ipBlock": {
+              "cidr": "10.0.56.200/32"
+            }
+          }
+        ]
+      },
+      {
+        "ports": [
+          {
+            "port": 11434,
+            "protocol": "TCP"
+          }
+        ],
+        "to": [
+          {
+            "ipBlock": {
+              "cidr": "0.0.0.0/0"
+            }
+          }
+        ]
+      }
+    ],
+    "ingress": [
+      {
+        "from": [
+          {
+            "namespaceSelector": {
+              "matchLabels": {
+                "kubernetes.io/metadata.name": "traefik-system"
+              }
+            }
+          }
+        ],
+        "ports": [
+          {
+            "port": 5300,
+            "protocol": "TCP"
+          }
+        ]
+      }
+    ],
+    "podSelector": {
+      "matchLabels": {
+        "app": "intranet-web"
+      }
+    },
+    "policyTypes": [
+      "Ingress",
+      "Egress"
+    ]
+  }
+}