init

network-policies/app/Dockerfile

@@ -0,0 +1,17 @@
+# Используем официальный образ Python
+FROM python:3.9-slim
+
+# Устанавливаем рабочую директорию
+WORKDIR /app
+
+# Копируем файлы приложения
+COPY app.py requirements.txt /app/
+
+# Устанавливаем зависимости
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Открываем порт для приложения
+EXPOSE 5000
+
+# Запускаем приложение
+CMD ["python", "app.py"]

network-policies/app/app.py

@@ -0,0 +1,19 @@
+from flask import Flask, Response
+from prometheus_client import Counter, generate_latest
+
+app = Flask(__name__)
+
+# Создаем счётчик запросов к корневому эндпоинту
+REQUEST_COUNT = Counter('app_requests_total', 'Total app HTTP requests', ['method', 'endpoint'])
+
+@app.route('/')
+def hello_world():
+    REQUEST_COUNT.labels(method='GET', endpoint='/').inc()
+    return 'Hello, World!'
+
+@app.route('/metrics')
+def metrics():
+    return Response(generate_latest(), mimetype='text/plain')
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=5000)

network-policies/app/requirements.txt

@@ -0,0 +1,2 @@
+Flask
+prometheus-client

network-policies/deny_all_ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deny-from-other-namespaces
+  namespace: devops-core-test-network-policies
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+      - podSelector: {}
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            heritage: deckhouse
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: kube-system

network-policies/deny_all_ingress_cilium.yaml

@@ -0,0 +1,24 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: "deny-cross-namespace-traffic-with-labeled-exceptions"
+spec:
+  description: "Cluster-wide policy to deny cross-namespace traffic, except for specific namespaces"
+  endpointSelector:
+    matchExpressions:
+    - key: "kubernetes.io/metadata.name"
+      operator: NotIn
+      values:
+      - kube-system
+    - key: "heritage"
+      operator: NotIn
+      values:
+      - deckhouse
+  ingress:
+  - fromEntities:
+    - cluster
+  - fromEndpoints:
+    - matchLabels:
+        kubernetes.io/metadata.name: kube-system
+    - matchLabels:
+        heritage: deckhouse

network-policies/deny_ingress_kyverno.yaml

@@ -0,0 +1,49 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-namespace-ingress
+spec:
+  generateExisting: true
+  background: true
+  rules:
+    - name: add-network-policy
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-*
+                - d8-*
+                - aqua
+      generate:
+        kind: NetworkPolicy
+        apiVersion: networking.k8s.io/v1
+        namespace: "{{request.object.metadata.name}}"
+        name: restrict-namespace-ingress
+        synchronize: true
+        data:
+          metadata:
+            name: restrict-namespace-ingress
+          spec:
+            podSelector: {}
+            policyTypes:
+              - Ingress
+            ingress:
+              - from:
+                  - podSelector: {}
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        heritage: deckhouse
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: kube-system
+              - from:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: aqua

network-policies/deployment.yaml

@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-app
+  namespace: first-test
+  labels:
+    app: test-app
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: test-app
+  template:
+    metadata:
+      labels:
+        app: test-app
+      annotations:
+        prometheus.deckhouse.io/custom-target: "test-app"
+        prometheus.deckhouse.io/port: "5000" 
+    spec:
+      containers:
+      - name: test-app
+        image: docker-local-devops.art.lmru.tech/test-network-policies:v0.1
+        ports:
+        - name: http
+          containerPort: 5000
+        imagePullPolicy: Always

network-policies/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: test-app-ingress
+  namespace: first-test
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: test-network-policies-polis-a-stage.apps.lmru.tech
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: test-app-service
+                port:
+                  number: 80

network-policies/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-app-service
+  namespace: first-test
+  labels:
+    app: test-app
+    prometheus.deckhouse.io/custom-target: "test-app"
+  annotations:
+    prometheus.deckhouse.io/port: "5000"
+spec:
+  selector:
+    app: test-app
+  ports:
+  - name: http
+    port: 80
+    targetPort: 5000