81 lines
2.1 KiB
Plaintext
81 lines
2.1 KiB
Plaintext
|
# Example PostgreSQL Network Policies (not applied by default)
|
||
|
|
# Uncomment and customize these if you want to implement network security for PostgreSQL
|
||
|
|
|
||
|
|
# ---
|
||
|
|
# apiVersion: "cilium.io/v2"
|
||
|
|
# kind: CiliumNetworkPolicy
|
||
|
|
# metadata:
|
||
|
|
# name: "postgresql-ingress"
|
||
|
|
# namespace: postgresql-system
|
||
|
|
# spec:
|
||
|
|
# description: "Allow ingress traffic to PostgreSQL pods"
|
||
|
|
# endpointSelector:
|
||
|
|
# matchLabels:
|
||
|
|
# postgresql: postgresql-shared
|
||
|
|
# ingress:
|
||
|
|
# # Allow CloudNativePG operator status checks
|
||
|
|
# - fromEndpoints:
|
||
|
|
# - matchLabels:
|
||
|
|
# app.kubernetes.io/name: cloudnative-pg
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "8000" # Status port
|
||
|
|
# protocol: "TCP"
|
||
|
|
#
|
||
|
|
# # Allow PostgreSQL connections from applications
|
||
|
|
# - fromEntities:
|
||
|
|
# - cluster # Allow any pod in cluster to connect
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "5432" # PostgreSQL port
|
||
|
|
# protocol: "TCP"
|
||
|
|
#
|
||
|
|
# # Allow PostgreSQL replication between instances
|
||
|
|
# - fromEndpoints:
|
||
|
|
# - matchLabels:
|
||
|
|
# postgresql: postgresql-shared # Allow PostgreSQL pods to talk to each other
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "5432"
|
||
|
|
# protocol: "TCP"
|
||
|
|
#
|
||
|
|
# # Allow metrics scraping (for OpenObserve)
|
||
|
|
# - fromEndpoints:
|
||
|
|
# - matchLabels:
|
||
|
|
# app: openobserve-collector
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "9187" # Metrics port
|
||
|
|
# protocol: "TCP"
|
||
|
|
|
||
|
|
# ---
|
||
|
|
# apiVersion: "cilium.io/v2"
|
||
|
|
# kind: CiliumNetworkPolicy
|
||
|
|
# metadata:
|
||
|
|
# name: "postgresql-egress"
|
||
|
|
# namespace: postgresql-system
|
||
|
|
# spec:
|
||
|
|
# description: "Allow egress traffic from PostgreSQL pods"
|
||
|
|
# endpointSelector:
|
||
|
|
# matchLabels:
|
||
|
|
# postgresql: postgresql-shared
|
||
|
|
# egress:
|
||
|
|
# # Allow DNS resolution
|
||
|
|
# - toEndpoints:
|
||
|
|
# - matchLabels:
|
||
|
|
# k8s-app: kube-dns
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "53"
|
||
|
|
# protocol: "UDP"
|
||
|
|
# - port: "53"
|
||
|
|
# protocol: "TCP"
|
||
|
|
#
|
||
|
|
# # Allow PostgreSQL replication
|
||
|
|
# - toEndpoints:
|
||
|
|
# - matchLabels:
|
||
|
|
# postgresql: postgresql-shared
|
||
|
|
# toPorts:
|
||
|
|
# - ports:
|
||
|
|
# - port: "5432"
|
||
|
|
# protocol: "TCP"
|