Merge pull request #571 from kartverket/SKIP-1456

Include load balancer on cloud clusters in default deny netpol
kartverket · Dec 18, 2024 · 104b321 · 104b321
2 parents d6db244 + 032421d
commit 104b321
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/pkg/resourcegenerator/networkpolicy/defaultdeny/default_deny_network_policy.go b/pkg/resourcegenerator/networkpolicy/defaultdeny/default_deny_network_policy.go
@@ -34,6 +34,24 @@ func Generate(r reconciliation.Reconciliation) error {
 							CIDR: "10.40.0.0/16",
 						},
 					},
+					// Egress rule for internal load balancer on atgcp1-sandbox
+					{
+						IPBlock: &networkingv1.IPBlock{
+							CIDR: "10.142.5.0/28",
+						},
+					},
+					// Egress rule for internal load balancer on atgcp1-dev
+					{
+						IPBlock: &networkingv1.IPBlock{
+							CIDR: "10.142.3.0/28",
+						},
+					},
+					// Egress rule for internal load balancer on atgcp1-prod
+					{
+						IPBlock: &networkingv1.IPBlock{
+							CIDR: "10.142.1.0/28",
+						},
+					},
 					// Egress rule for Internet
 					{
 						IPBlock: &networkingv1.IPBlock{

diff --git a/tests/namespace/default-deny/assert.yaml b/tests/namespace/default-deny/assert.yaml
@@ -13,6 +13,12 @@ spec:
   - to:
     - ipBlock:
         cidr: 10.40.0.0/16
+    - ipBlock:
+        cidr: 10.142.5.0/28
+    - ipBlock:
+        cidr: 10.142.3.0/28
+    - ipBlock:
+        cidr: 10.142.1.0/28
     - ipBlock:
         cidr: 0.0.0.0/0
         except: