search

defenseunicorns / uds-package-confluence

🏪 UDS Confluence Zarf Package
GNU Affero General Public License v3.0
0 stars 0 forks source link

fix: restrict network policies closer to what is minimum required access #25

Closed JoeHCQ1 closed 3 months ago

JoeHCQ1 commented 3 months ago

This restricts the network policies. It does not close #7 as the following changes are still required:

  1. Once clustering is enabled #26, the network policy enabling clustering must be confirmed. If multicast is required to create the cluster (alternative is we hard-code to pod IPs) then the policies as-is are likely to require changes.
  2. As monitoring is shown to be working properly #12, the policies related to Prometheus will need validated.
  3. Once Synchrony is enabled, like node clustering, the policies which enable these comms will need added and validated.
  4. Once restrictive egress is enabled in UDS core https://github.com/defenseunicorns/uds-core/issues/558 the egress to postgresql needs restricted.

That said, for the capabilities which were known to exist before this work started, the network policies have been restricted.

JoeHCQ1 commented 3 months ago

Closing this for now. #34 made it largely irrelevant. I can still restrict the intra namespace policy but I don't want to do that until I have clustering working so I can confirm that my policies are not breaking anything.