{{ if .Values.defaultDeny.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ .Release.Name }}-default-deny
namespace: {{ .Release.Namespace }}
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
{{ end }}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ .Release.Name }}-allow-dns
namespace: {{ .Release.Namespace }}
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- protocol: UDP
port: 53
- protocol: TCP

port: 53

{{ range .Values.policies }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ $.Release.Name }}-{{ .name }}-policy
namespace: {{ $.Release.Namespace }}
spec:
podSelector:
matchLabels:
app: {{ .targetApp }}
policyTypes:
- Ingress
ingress:
{{ range .allowedClients }}
- from:
- podSelector:
matchLabels:
app: {{ .app }}
ports:
- protocol: TCP
port: {{ .port }}

{{ end }}

{{ end }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ .Release.Name }}-frontend-egress
namespace: {{ .Release.Namespace }}
spec:
podSelector:
matchLabels:
app: frontend
policyTypes:
- Egress
egress:
- to:
- podSelector:
matchLabels:
app: backend
ports:
- protocol: TCP
port: 80

defaultDeny:
enabled: true

policies:

  • name: backend-access targetApp: backend allowedClients:
    • app: frontend port: 80``