Merge pull request #26 from kaviththiranga/master

Prevent outbound traffic from executors
ballerina-attic · Nov 25, 2019 · a782b25 · a782b25
2 parents c3d6534 + d91b774
commit a782b25
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 0 deletions.
diff --git a/k8s/network/Readme.md b/k8s/network/Readme.md
@@ -0,0 +1,12 @@
+# Enable
+gcloud container clusters create [CLUSTER_NAME] --enable-network-policy
+
+or 
+
+gcloud container clusters update [CLUSTER_NAME] --update-addons=NetworkPolicy=ENABLED
+gcloud container clusters update [CLUSTER_NAME] --enable-network-policy
+
+
+# Disable
+
+gcloud container clusters update [CLUSTER_NAME] --no-enable-network-policy
diff --git a/k8s/network/egress-block.yaml b/k8s/network/egress-block.yaml
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: deny-egress-traffic
+ namespace: ballerina-playground-v2
+spec:
+ policyTypes:
+ - Egress
+ podSelector:
+ matchLabels:
+ app: ballerina-playground-executor
+ egress:
+ - to:
+ - podSelector:
+ matchLabels:
+ app: ballerina-playground-controller
+ - ports:
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
+