Add basic network policy for Ingress to Workers#340
Conversation
258d8e5 to
6c7e48a
Compare
Restrict Ingress to Workers and hence Actors to be only from the Router component. This makes the atecontroller responsible for K8s level network policy Note: this is a belts-and-suspenders model as this applies on the Worker level. This will be refined further with Actor-specific policies.
6c7e48a to
120b007
Compare
| networkingv1ac.NetworkPolicyEgressRule(), | ||
| )) | ||
|
|
||
| // TODO: don't implement any Egress policy yet. |
There was a problem hiding this comment.
So for egress, the NetworkPolicy would apply to ateom -> PEP and prevents worker pods from bypassing the PEP at the Kubernetes network layer?
There was a problem hiding this comment.
Yes, we can't express the policy directly in Kubernetes NetworkPolicy ... nor do we want to, at least in the K8s's current incarnation. The way to understand this PR is that it is very targeted.
There was a problem hiding this comment.
I avoided doing anything here right now as to wait for more progress on what the Egress APIs might look and also some of the rules may not be expressible at the k8s layer.
|
/retest |
|
Bowei Du (@bowei) , the failed e2e-test does not seem to relate to this PR. |
|
Bowei Du (@bowei) , let us close this PR and follow up on #488 |
|
Looks like HaiYan has taken this one, closing. |
3 participants
Restrict Ingress to Workers and hence Actors to be only from the Router component.
This makes the atecontroller responsible for K8s level network policy
Part of hardening network connectivity for:
#175