-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Update cluster defaults package with network policies (#866)
Summary In order to comply with the nist-sp-800-53-r5-require-namespace-network-policies constraint (of [NIST SP 800-53 Rev. 5 Policy Controller bundle](https://github.com/GoogleCloudPlatform/gke-policy-library/tree/main/anthos-bundles/nist-sp-800-53-r5)), cluster-defaults package required updates to add network policies to the gateway-infra and default namespaces. Details of gateway-infra namespace Network Policy: Added cluster-defaults/admin-namespaces/networkpolicy.yaml file to implement network policy in the gateway-infra namespace. Network policies implement following rules: - Allow ingress within namespace - Allow ingress from lb health check - Allow egress within namespace - Allow egress to metadata server - Allow egress for GCP API - Allow egress to private IP ranges (includes K8S cluster) Details of default namespace Network Policy: Added cluster-defaults/default-namespace/networkpolicy.yaml file to implement network policy in the default namespace Network policies implement following rules: - Allow ingress within namespace - Allow egress within namespace
- Loading branch information
1 parent
2b5ff79
commit 2bfcd83
Showing
4 changed files
with
235 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
139 changes: 139 additions & 0 deletions
139
solutions/gke/kubernetes/cluster-defaults/admin-namespaces/networkpolicy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| # Copyright 2021 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| ######### | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) - Network Policies to allow or deny ingress and egress traffic to/from gateway-infra namespace | ||
| # Allow ingress within namespace | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: gateway-infra | ||
| name: allow-ingress-within-namespace | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| ingress: | ||
| # From all pods within the same namespace | ||
| - from: | ||
| - podSelector: {} | ||
| --- | ||
| # Allow ingress from lb health check | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: gateway-infra | ||
| name: allow-ingress-from-lb-health-check | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| ingress: | ||
| - from: | ||
| - ipBlock: | ||
| cidr: 35.191.0.0/16 | ||
| - from: | ||
| - ipBlock: | ||
| cidr: 130.211.0.0/22 | ||
| - from: | ||
| - ipBlock: | ||
| cidr: 209.85.152.0/22 | ||
| - from: | ||
| - ipBlock: | ||
| cidr: 209.85.204.0/22 | ||
| --- | ||
| # Allow egress within namespace | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: gateway-infra | ||
| name: allow-egress-within-namespace | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| egress: | ||
| # To all pods within the same namespace | ||
| - to: | ||
| - podSelector: {} | ||
| --- | ||
| # Allow egress to metadata server | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: gateway-infra | ||
| name: allow-egress-to-metadata-server | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| egress: | ||
| # Network policy and Workload Identity | ||
| # For clusters running GKE version 1.21.0-gke.1000 and later, allow egress to 169.254.169.252/32 on port 988 | ||
| # For clusters running GKE Dataplane V2, allow egress to 169.254.169.254/32 on port 80 | ||
| # Allow access to NodeLocal DNSCache on ip 169.254.20.10 and port 53 | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 169.254.169.252/32 | ||
| ports: | ||
| - port: 988 | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 169.254.169.254/32 | ||
| ports: | ||
| - port: 53 | ||
| protocol: UDP | ||
| - port: 53 | ||
| protocol: TCP | ||
| - port: 80 | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 169.254.20.10/32 | ||
| ports: | ||
| - port: 53 | ||
| protocol: UDP | ||
| - port: 53 | ||
| protocol: TCP | ||
| --- | ||
| # Allow egress for GCP API | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| namespace: gateway-infra | ||
| name: allow-egrees-to-gcp-api | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| egress: | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 10.255.255.254/32 | ||
| ports: | ||
| - port: 443 | ||
| --- | ||
| # Allow egress to private IP ranges (includes K8S cluster) | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| name: allow-private-egress | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| policyTypes: | ||
| - Egress | ||
| egress: | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 10.0.0.0/8 | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 192.168.0.0/16 | ||
| - to: | ||
| - ipBlock: | ||
| cidr: 172.16.0.0/20 |
42 changes: 42 additions & 0 deletions
42
solutions/gke/kubernetes/cluster-defaults/default-namespace/networkpolicy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # Copyright 2021 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| ######### | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) - Network Policies to allow or deny ingress and egress traffic to/from default namespace | ||
| # Allow ingress within namespace | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: default | ||
| name: allow-ingress-within-default-namespace | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| ingress: | ||
| # From all pods within the same namespace | ||
| - from: | ||
| - podSelector: {} | ||
| --- | ||
| # Allow egress within namespace | ||
| kind: NetworkPolicy | ||
| apiVersion: networking.k8s.io/v1 | ||
| metadata: | ||
| namespace: default | ||
| name: allow-egress-within-default-namespace | ||
| spec: | ||
| podSelector: {} | ||
| # AC-4, AC-4(21), SC-7(5), SC-7(9), SC-7(11) | ||
| egress: | ||
| # To all pods within the same namespace | ||
| - to: | ||
| - podSelector: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters