A pod calledredis-backendhas been created in theprod-x12csnamespace. It has
been exposed as a service of typeClusterIP. Using a network policy calledallow-
redis-access, lock down access to this pod only to the following:
1. Any pod in the same namespace with the labelbackend=prod-x12cs.
2. All pods in theprod-yx13csnamespace.
All other incoming connections should be blocked.
Use theexisting labelswhen creating the network policy.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-redis-access
namespace: prod-x12cs
spec:
podSelector:
matchLabels:
run: redis-backend
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
access: redis
- podSelector:
matchLabels:
backend: prod-x12cs
ports:
- protocol: TCP
port: 6379
评论0