From 4d89d0185cc1fed80d0a4c8ada1c6e7e35ca8096 Mon Sep 17 00:00:00 2001 From: Hussein Galal Date: Sat, 17 Jul 2021 02:34:59 +0200 Subject: [PATCH] Add network policy for traefik ingress (#3389) * Add network policy for traefik ingress * fix typo --- .../en/security/hardening_guide/_index.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md index 53964eb43dd..747bab7bb42 100644 --- a/content/k3s/latest/en/security/hardening_guide/_index.md +++ b/content/k3s/latest/en/security/hardening_guide/_index.md @@ -302,6 +302,28 @@ spec: - Ingress ``` +If you are using the default traefik ingress controller with k3s, it will also be blocked by default, so the following network policy must be added to allow traffic to both traefik pods and svclb pods in the kube-system namespace: + +```yaml +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-network-traefik-policy + namespace: kube-system +spec: + ingress: + - ports: + - port: 80 + protocol: TCP + - port: 443 + protocol: TCP + podSelector: + matchExpressions: + - {key: app, operator: In, values: [traefik,svclb-traefik]} + policyTypes: + - Ingress +``` + > **Note:** Operators must manage network policies as normal for additional namespaces that are created. ## Known Issues