96 lines
1.9 KiB
YAML
96 lines
1.9 KiB
YAML
# Vérification que le CNI applique bien les NetworkPolicy avant de faire
|
|
# confiance à deploy/chart-gestion/network-policy pour l'isolation des démos.
|
|
#
|
|
# kubectl apply -f deploy/cni/network-policy-test.yml
|
|
# kubectl wait -n netpol-test --for=condition=ready pod -l app=target --timeout=60s
|
|
#
|
|
# # Doit réussir (client autorisé) :
|
|
# kubectl exec -n netpol-test allowed-client -- wget -qO- --timeout=2 target
|
|
#
|
|
# # Doit échouer / timeout (client non autorisé — c'est le résultat attendu) :
|
|
# kubectl exec -n netpol-test blocked-client -- wget -qO- --timeout=2 target
|
|
#
|
|
# Si "blocked-client" arrive quand même à joindre "target", le CNI n'applique
|
|
# PAS les NetworkPolicy : deploy/chart-gestion/network-policy ne protège rien.
|
|
#
|
|
# Nettoyage : kubectl delete namespace netpol-test
|
|
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: netpol-test
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: target
|
|
namespace: netpol-test
|
|
labels:
|
|
app: target
|
|
spec:
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.27-alpine
|
|
ports:
|
|
- containerPort: 80
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: target
|
|
namespace: netpol-test
|
|
spec:
|
|
selector:
|
|
app: target
|
|
ports:
|
|
- port: 80
|
|
targetPort: 80
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: allowed-client
|
|
namespace: netpol-test
|
|
labels:
|
|
role: allowed
|
|
spec:
|
|
containers:
|
|
- name: busybox
|
|
image: busybox:1.37
|
|
command: ["sh", "-c", "sleep 3600"]
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: blocked-client
|
|
namespace: netpol-test
|
|
labels:
|
|
role: blocked
|
|
spec:
|
|
containers:
|
|
- name: busybox
|
|
image: busybox:1.37
|
|
command: ["sh", "-c", "sleep 3600"]
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-only-labeled
|
|
namespace: netpol-test
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: target
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
role: allowed
|