adjust policy for dns

2026-01-17 20:33:50 -05:00
parent f4e0053b56
commit 03f99cae2e
2 changed files with 38 additions and 13 deletions
@@ -11,21 +11,20 @@ spec:
    - Egress

  ingress:
+  ### Allow intra-namespace communication
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: irc
+  ###
+  ### Allow traffic from gateways
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: istio-system
-
+  ###
  egress:
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: irc
-
+  ### Allow DNS resolution
    - to:
        - namespaceSelector:
            matchLabels:
@@ -38,11 +37,19 @@ spec:
          port: 53
        - protocol: TCP
          port: 53
-
+  ###
+  ### Allow intra-namespace communication
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: irc
+  ###
+  ### Allow outbound to the world
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
-              - 192.168.0.0/16
+              - 192.168.0.0/16
+  ###
@@ -11,27 +11,45 @@ spec:
    - Egress

  ingress:
+  ### Allow intra-namespace communication
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: irc
+  ###
+  ### Allow traffic from gateways
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: istio-system
-
+  ###
  egress:
-    # namespace-local
+  ### Allow DNS resolution
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+  ###
+  ### Allow intra-namespace communication
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: irc
-
-    # public internet only
+  ###
+  ### Allow outbound to the world
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
-              - 192.168.0.0/16
+              - 192.168.0.0/16
+  ###