forked from vhaudiquet/homeprod
kosmosandvhaudiquet
e242b2ddce
The operator's managed policy is default-deny with egress limited to DNS and TCP 443, so reaching a LAN service on any other port is dropped. Measured against 10.4.1.222 from inside the pod: 443 returns RST while 7020 times out, so routing is fine and the port is what gets refused. Add a supplementary egress policy admitting 10.0.0.0/8, excluding the service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not grant every pod a path out. No port list: the point is arbitrary LAN services. Registered in the directory kustomization alongside the existing mail and radicale egress policies.
11 lines
279 B
YAML
11 lines
279 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: openclaw
|
|
resources:
|
|
- openclaw-instance.yaml
|
|
- openclaw-secrets.yaml
|
|
- networkpolicy.yaml
|
|
- networkpolicy-lan-egress.yaml
|
|
- networkpolicy-mail-egress.yaml
|
|
- networkpolicy-radicale-egress.yaml
|