Merge pull request #16 from jujaga/sec/ingress

Implement more specific openshift ingress network policy
bcgov · Jan 17, 2024 · 302f43a · 302f43a
2 parents 3a47f79 + 066ab44
commit 302f43a
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/openshift/app.dc.yaml b/openshift/app.dc.yaml
@@ -21,6 +21,22 @@ labels:
   app.openshift.io/runtime: golang
   template: "${REPO_NAME}-app-template"
 objects:
+  - apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: "allow-openshift-ingress-to-${APP_NAME}-app"
+    spec:
+      podSelector:
+        matchLabels:
+          app: "${APP_NAME}-app"
+          role: app
+      ingress:
+        - from:
+            - namespaceSelector:
+                matchLabels:
+                  network.openshift.io/policy-group: ingress
+      policyTypes:
+        - Ingress
   - apiVersion: v1
     kind: ConfigMap
     metadata: