init

network-policies/deny_all_ingress_cilium.yaml

@@ -0,0 +1,24 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: "deny-cross-namespace-traffic-with-labeled-exceptions"
+spec:
+  description: "Cluster-wide policy to deny cross-namespace traffic, except for specific namespaces"
+  endpointSelector:
+    matchExpressions:
+    - key: "kubernetes.io/metadata.name"
+      operator: NotIn
+      values:
+      - kube-system
+    - key: "heritage"
+      operator: NotIn
+      values:
+      - deckhouse
+  ingress:
+  - fromEntities:
+    - cluster
+  - fromEndpoints:
+    - matchLabels:
+        kubernetes.io/metadata.name: kube-system
+    - matchLabels:
+        heritage: deckhouse