networkpolicy

package
v1.31.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 1, 2023 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Index

Constants

View Source
const PrometheusSelector = "" /* 149-byte string literal not displayed */
View Source
const TigeraComponentDefaultDenyPolicyName = TigeraComponentPolicyPrefix + "default-deny"
View Source
const TigeraComponentPolicyPrefix = TigeraComponentTierName + "."
View Source
const TigeraComponentTierName = "allow-tigera"

Variables

View Source
var AfterHighPrecendenceOrder = 10.0
View Source
var ESGatewayEntityRule = CreateEntityRule("tigera-elasticsearch", "tigera-secure-es-gateway", 5554)

The entity rules below are extracted from render subpackages to prevent cyclic dependencies.

View Source
var ESGatewayServiceSelectorEntityRule = CreateServiceSelectorEntityRule("tigera-elasticsearch", "tigera-secure-es-gateway-http")
View Source
var ESGatewaySourceEntityRule = CreateSourceEntityRule("tigera-elasticsearch", "tigera-secure-es-gateway")
View Source
var HighPrecedenceOrder = 1.0
View Source
var KubeAPIServerEntityRule = v3.EntityRule{
	NamespaceSelector: "projectcalico.org/name == 'default'",
	Selector:          "(provider == 'kubernetes' && component == 'apiserver' && endpoints.projectcalico.org/serviceName == 'kubernetes')",
	Ports:             Ports(443, 6443, 12388),
}

Entity rules not belonging to Calico/Tigera components.

View Source
var KubeAPIServerServiceSelectorEntityRule = v3.EntityRule{
	Services: &v3.ServiceMatch{
		Namespace: "default",
		Name:      "kubernetes",
	},
}
View Source
var LinseedEntityRule = CreateEntityRule("tigera-elasticsearch", "tigera-linseed", 8444)
View Source
var LinseedServiceSelectorEntityRule = CreateServiceSelectorEntityRule("tigera-elasticsearch", "tigera-linseed")
View Source
var LinseedSourceEntityRule = CreateSourceEntityRule("tigera-elasticsearch", "tigera-linseed")
View Source
var PrometheusEntityRule = v3.EntityRule{
	NamespaceSelector: "projectcalico.org/name == 'tigera-prometheus'",
	Selector:          PrometheusSelector,
	Ports:             Ports(9095),
}
View Source
var PrometheusSourceEntityRule = v3.EntityRule{
	NamespaceSelector: "name == 'tigera-prometheus'",
	Selector:          PrometheusSelector,
}

Functions

func AllowTigeraDefaultDeny

func AllowTigeraDefaultDeny(namespace string) *v3.NetworkPolicy

func AppendDNSEgressRules

func AppendDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule

AppendDNSEgressRules appends a rule to the provided slice that allows DNS egress. The appended rule utilizes label selectors and ports.

func AppendServiceSelectorDNSEgressRules

func AppendServiceSelectorDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule

AppendServiceSelectorDNSEgressRules is equivalent to AppendDNSEgressRules, utilizing service selector instead of label selector and ports.

func CreateEntityRule

func CreateEntityRule(namespace string, deploymentName string, ports ...uint16) v3.EntityRule

CreateEntityRule creates an entity rule that matches traffic using label selectors based on namespace, deployment name, and port.

func CreateServiceSelectorEntityRule

func CreateServiceSelectorEntityRule(namespace string, name string) v3.EntityRule

CreateServiceSelectorEntityRule creates an entity rule that matches traffic based on service name and namespace.

func CreateSourceEntityRule

func CreateSourceEntityRule(namespace string, deploymentName string) v3.EntityRule

CreateSourceEntityRule creates a conventional entity rule that matches ingress traffic based on namespace and deployment name.

func KubernetesAppSelector

func KubernetesAppSelector(deploymentNames ...string) string

func Ports

func Ports(ports ...uint16) []numorstring.Port

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL