Policy does not restrict ingress sources Affecting Network Policy service in Kubernetes

Add ingress rules which only allow access to specific services, or from limited sources.

Example configuration:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress-rule-multi
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
    - from:
        - ipBlock:
            cidr: 172.17.0.0/16
            except:
              - 172.17.1.0/24
  policyTypes:
    - Ingress

Add ingress rules which only allow access to specific services, or from limited sources.

Example configuration:

resource "kubernetes_network_policy" "allowed" {
  metadata {
    name      = "allowed"
    namespace = "default"
  }

  spec {
    # pod_selector is required by terraform validation
    pod_selector {
      # equal to empty match expression 
      match_expressions {}
    }

    ingress {
      ports {
        port     = "http"
        protocol = "TCP"
      }
      ports {
        port     = "8125"
        protocol = "UDP"
      }
    }

    egress {} # single empty rule to allow all egress traffic

    policy_types = ["Ingress", "Egress"]
  }
}

resource "kubernetes_network_policy" "allowed_2" {
  metadata {
    name      = "allowed-2"
    namespace = "default"
  }

  spec {
    # pod_selector is required by terraform validation
    pod_selector {
      match_expressions {
        key      = "name"
        operator = "In"
        values   = ["webfront", "api"]
      }
    }

    ingress {} # allow all traffic

    egress {} # single empty rule to allow all egress traffic

    policy_types = ["Ingress", "Egress"]
  }
}

resource "kubernetes_network_policy" "allowed_3" {
  metadata {
    name      = "allowed-3"
    namespace = "default"
  }

  spec {
    pod_selector {
    }

    ingress {}

    egress {} # single empty rule to allow all egress traffic

    policy_types = ["Egress"]
  }
}

resource "kubernetes_network_policy" "default_allowed" {
  metadata {
    name      = "default-deny"
    namespace = "default"
  }

  spec {
    # pod_selector is required by terraform validation
    pod_selector {}

    policy_types = ["Ingress"]
  }
}