design-mode.yaml

APIVersion: 1
label: recipe:design-mode
data:
  recipes:
  - name: Enable Discovery Mode
    description: Allow all traffic.
    label: recipe:design-mode
    propagate: true
    deploymentMode: Unique
    metadata:
    - "@aporeto:author=aporeto"
    associatedTags:
    - "aporeto:recipe:placement=toolbar"
    targetIdentities:
    - externalnetwork
    - networkaccesspolicy
    longDescription: |-
      ### Enable Discovery Mode

      When discovery mode is enabled, **all flows are accepted**.

      Flows which do not match an existing network policy will be represented by a dotted line in your Platform view

    template: |-
      {{`
      APIVersion: 1
      data:
        networkaccesspolicies:
        - name: "discovery-mode"
          description: "Allow all processing units and external networks commnications."
          action: "Allow"
          observationEnabled: true
          observedTrafficAction: "Apply"
          protected: false
          logsEnabled: true
          {{- if .Values.propagate }}
          propagate: true
          {{- end }}
          subject:
          - - "$identity=processingunit"
          - - "$identity=externalnetwork"
          object:
          - - "$identity=processingunit"
          - - "$identity=externalnetwork"
        externalnetworks:
        - name: "any-udp"
          description: "Represents any UDP traffic"
          {{- if .Values.propagate }}
          propagate: true
          {{- end }}
          entries:
          - "0.0.0.0/0"
          - "::/0"
          servicePorts:
          - "udp/1:65535"
        - name: "any-tcp"
          description: "Represents any TCP traffic"
          {{- if .Values.propagate }}
          propagate: true
          {{- end }}
          entries:
          - "0.0.0.0/0"
          - "::/0"
          servicePorts:
          - "tcp/1:65535"
        - name: "any-icmp"
          description: "Represents any ICMP traffic"
          {{- if .Values.propagate }}
          propagate: true
          {{- end }}
          entries:
          - "0.0.0.0/0"
          - "::/0"
          servicePorts:
          - "icmp"
          - "icmp6"
        - name: "any-other-protocol"
          description: "Represents any other traffic"
          {{- if .Values.propagate }}
          propagate: true
          {{- end }}
          entries:
          - "0.0.0.0/0"
          - "::/0"
          servicePorts:
          - "IGMP"
          - "SCTP"
          - "IPIP"
          - "GRE"
          - "PIM"
          - "VRRP"
          - "L2TP"
      `}}
    steps:
    - name: Propagation
      description: Configure if the Discovery Mode should be enabled in the child namespaces.
      parameters:
      - key: propagate
        name: Propagate
        description: propagate down to child namespaces.
        type: Boolean