some improved formatting.

This commit is contained in:
Erik Brakkee 2025-04-10 20:28:16 +02:00
parent a5b858ff27
commit a78d857a87

View File

@ -7,13 +7,15 @@ Basic idea:
Allowed communication betwen applications is configured as follows: Allowed communication betwen applications is configured as follows:
```
communication: communication:
- from: app1 - from: app1
to: app2 to: app2
ports: ports:
- 80 - 80
- linkerd-admin - linkerd-admin
```
Ports are optional. When omitted all ports are intended Ports are optional. When omitted all ports are intended
There are pre-defined applications such as api-server. There are pre-defined applications such as api-server.
@ -28,11 +30,8 @@ There are also standard capablities for an application such as:
* linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from * linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from
linkerd-viz linkerd-viz
capablities can also be defined at the namespace level, which means they
apply to each pod in the namespace.
```
networks: networks:
- name: internet - name: internet
cidr: 0.0.0.0/0 cidr: 0.0.0.0/0
@ -40,8 +39,11 @@ networks:
- 10.0.0.0/8 - 10.0.0.0/8
- 172.16.0.0/12 - 172.16.0.0/12
- 192.168.0.0/16 - 192.168.0.0/16
```
capablities can also be defined at the namespace level, which means they
apply to each pod in the namespace
```
namespaces: namespaces:
- namespace: wamblee-org - namespace: wamblee-org
capabilities: capabilities:
@ -75,32 +77,11 @@ communications:
- httpd-wamblee-org - httpd-wamblee-org
to: to:
- nexus-server - nexus-server
porst: ports:
- 8081 - 8081
- 8082 - 8082
Handling of capabilities:
1. capabilities at namespace level is defined a template that gets the namespace name.
Ingress template
from:
- linkerd-viz
to:
- {{ application }}
egress template
from:
- {{ application }}
to:
- linkerd-jaeger
- linkerd
The templates are evaluated for an application and then parsed, and added
to the allowed communications.
Linkerd extension: Linkerd extension:
* for each application an optional service account is defined, when not * for each application an optional service account is defined, when not