Merge remote-tracking branch 'origin/re-2167/fix-network-policies-hel…

…m' into re-2167/fix-network-policies-helm
smartcontractkit · Jan 18, 2024 · 90987fe · 90987fe
2 parents 0c5cbb1 + 562e26a
commit 90987fe
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 9 deletions.
diff --git a/charts/chainlink-cluster/templates/networkpolicy-default-deny-ingress.yaml b/charts/chainlink-cluster/templates/networkpolicy-default-deny-ingress.yaml
diff --git a/charts/chainlink-cluster/templates/networkpolicy-default-deny.yaml b/charts/chainlink-cluster/templates/networkpolicy-default-deny.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  podSelector:
+    matchLabels: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: "{{ $.Release.Namespace }}"
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: TCP
+          port: 53
+        - protocol: UDP
+          port: 53
diff --git a/charts/chainlink-cluster/templates/runner-networkpolicy.yaml b/charts/chainlink-cluster/templates/runner-networkpolicy.yaml
@@ -13,7 +13,7 @@ spec:
     - from:
       - podSelector:
           matchLabels:
-          app: {{ $.Release.Name }}
+            app: {{ $.Release.Name }}
       - podSelector:
           matchLabels:
             app: runner