e25bc8d835
Caught during pre-apply review:
- Scope default-deny/allow-dns/allow-monitoring to pods with
app.kubernetes.io/part-of=foxhunt (was podSelector:{} which would
block gitlab, grafana, loki sharing the namespace)
- Fix infrastructure.yaml: use app.kubernetes.io/name instead of
bare app label for postgres/redis/minio/questdb podSelectors
- Add app.kubernetes.io/part-of=foxhunt to all pod templates so
default-deny and infrastructure ingress rules match correctly
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
17 lines
406 B
YAML
17 lines
406 B
YAML
# Default deny all ingress and egress in foxhunt namespace.
|
|
# Every service must declare its own NetworkPolicy to communicate.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-all
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|