94 lines
2.1 KiB
YAML
94 lines
2.1 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: argo-gpu-test-workflow
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: gpu-test
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# DNS
|
|
- ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
# Kubernetes API + internal services (service CIDR)
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 10.32.0.0/16
|
|
- ipBlock:
|
|
cidr: 172.16.0.4/32
|
|
# HTTPS egress (crates.io, etc.)
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
# Git SSH (GitLab)
|
|
- ports:
|
|
- port: 2222
|
|
protocol: TCP
|
|
to:
|
|
- ipBlock:
|
|
cidr: 100.90.76.85/32
|
|
- podSelector:
|
|
matchLabels:
|
|
app: gitlab-shell
|
|
# GitLab webservice (git-http)
|
|
- ports:
|
|
- port: 8181
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: webservice
|
|
# MinIO (artifact/log storage)
|
|
- ports:
|
|
- port: 9000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
# Pushgateway (Prometheus metrics)
|
|
- ports:
|
|
- port: 9091
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: pushgateway
|
|
# OTLP (Tempo)
|
|
- ports:
|
|
- port: 4317
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: tempo
|
|
# Mattermost (notifications)
|
|
- ports:
|
|
- port: 8065
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mattermost
|
|
# GitLab container registry
|
|
- ports:
|
|
- port: 5000
|
|
protocol: TCP
|
|
to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: registry
|