mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
24 lines
647 B
YAML
24 lines
647 B
YAML
# Allow all pods to reach CoreDNS for name resolution
|
|
# Uses enableDefaultDeny: false to avoid blocking non-DNS egress traffic
|
|
# Istio AuthorizationPolicies handle zero-trust enforcement at L7
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: allow-dns
|
|
spec:
|
|
endpointSelector: {}
|
|
enableDefaultDeny:
|
|
egress: false
|
|
ingress: false
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- port: "53"
|
|
protocol: UDP
|
|
- port: "53"
|
|
protocol: TCP
|