25 lines
636 B
YAML
25 lines
636 B
YAML
apiVersion: "cilium.io/v2"
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: "deny-cross-namespace-traffic-with-labeled-exceptions"
|
|
spec:
|
|
description: "Cluster-wide policy to deny cross-namespace traffic, except for specific namespaces"
|
|
endpointSelector:
|
|
matchExpressions:
|
|
- key: "kubernetes.io/metadata.name"
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- key: "heritage"
|
|
operator: NotIn
|
|
values:
|
|
- deckhouse
|
|
ingress:
|
|
- fromEntities:
|
|
- cluster
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
- matchLabels:
|
|
heritage: deckhouse
|