128 lines
3.1 KiB
YAML
128 lines
3.1 KiB
YAML
# Isolation réseau du namespace cert-manager — même logique que
|
|
# deploy/chart-gestion/network-policy (deny-by-default + allowlist), adaptée
|
|
# aux flux réels de cert-manager :
|
|
# - Ingress : l'API server appelle le webhook d'admission de cert-manager
|
|
# (validation des CRD Certificate/Issuer/ClusterIssuer) sur le port 10250.
|
|
# - Egress : API server (lecture/écriture des CRD + Secrets), DNS, et
|
|
# Internet en HTTPS (Let's Encrypt ACME + API Cloudflare pour le
|
|
# challenge DNS-01 — IPs non fixes, pas de CIDR précis possible).
|
|
#
|
|
# ⚠️ AVANT D'APPLIQUER : remplacer CHANGE_ME_apiserver_ip par l'IP réelle de
|
|
# l'API server de votre cluster (trouvable via :
|
|
# kubectl get endpoints kubernetes -n default -o wide
|
|
# ). Une mauvaise valeur bloque l'accès de cert-manager à l'API Kubernetes —
|
|
# le renouvellement automatique des certificats s'arrête silencieusement
|
|
# (pas d'impact immédiat, le cert en cours reste valide jusqu'à expiration).
|
|
# Testez avec `kubectl apply --dry-run=server` puis surveillez
|
|
# `kubectl get certificate -A` après application.
|
|
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-all
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-intra-namespace
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
egress:
|
|
- to:
|
|
- podSelector: {}
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-apiserver-webhook
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- ipBlock:
|
|
cidr: CHANGE_ME_apiserver_ip/32
|
|
ports:
|
|
- protocol: TCP
|
|
port: 10250
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-dns
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-apiserver
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- ipBlock:
|
|
cidr: CHANGE_ME_apiserver_ip/32
|
|
ports:
|
|
- protocol: TCP
|
|
port: 6443
|
|
|
|
---
|
|
# Let's Encrypt (ACME) + API Cloudflare (challenge DNS-01) : IPs publiques
|
|
# non fixes, seul HTTPS sortant est nécessaire.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-internet-https
|
|
namespace: cert-manager
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|