policy-suggest-intra-k8s-namespaces.yaml

APIVersion: 1
label: recipe:policy-suggest:auto-secure_intra-k8s_namespaces
data:
  recipes:
    - name: Auto-Secure Intra-Kubernetes Namespaces
      description: Creates a Network Ruleset Policy to allow Kubernetes namespace traffic.
      label: recipe:policy-suggest:auto-secure_intra-k8s_namespaces
      metadata:
        - "@aporeto:author=aporeto"
      associatedTags:
        - "aporeto:recipe:placement=policy-suggest"
        - "aporeto:recipe:placement=intra-namespace"
        - "aporeto:recipe:placement=kubernetes-level"
      deploymentMode: NamespaceUnique
      targetIdentities:
        - networkrulesetpolicy
      propagate: true
      longDescription: |-
        ### Auto-secure intra-kubernetes namespaces

        This recipe will create a Network Ruleset Policy to auto-secure
        a Kubernetes namespace (fourth-level namespaces).

      template: |-
        {{`
        APIVersion: 1
        data:
          networkrulesetpolicies:
          - name: auto-secure_intra-k8s_namespaces
            description: "Ruleset automatically created by an Out of Box template."
            propagate: true
            subject:
            {{- range $index, $orgmeta := .Aporeto.OrganizationalMetadata }}
            {{- if eq $index 0 }}
            - - {{ $orgmeta | quote }}
            {{- else }}
              - {{ $orgmeta | quote }}
            {{- end }}
            {{- end }}
            incomingRules:
            - action: Allow
              protocolPorts:
              - any
              object:
              - - "$identity=processingunit"
              {{- range $_, $orgmeta := .Aporeto.OrganizationalMetadata }}
                - {{ $orgmeta | quote }}
              {{- end }}
            outgoingRules:
            - action: Allow
              protocolPorts:
              - any
              object:
              - - "$identity=processingunit"
              {{- range $_, $orgmeta := .Aporeto.OrganizationalMetadata }}
                - {{ $orgmeta | quote }}
              {{- end }}
        `}}