-
Notifications
You must be signed in to change notification settings - Fork 4
/
policy-suggest-authorized-registries.yaml
66 lines (63 loc) · 2.37 KB
/
policy-suggest-authorized-registries.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
APIVersion: 1
label: recipe:policy-suggest:authorized_registries
data:
recipes:
- name: K8s Host Mode - Create Allow Nodes to Pull Images from Authorized Registries Rule
description: Creates a rule to allow traffic from authorized registries to pull images.
label: recipe:policy-suggest:authorized_registries
metadata:
- "@aporeto:author=aporeto"
associatedTags:
- "aporeto:recipe:placement=policy-suggest"
- "aporeto:recipe:placement=k8s-rules"
- "aporeto:recipe:placement=group-level"
deploymentMode: NamespaceUnique
targetIdentities:
- externalnetwork
- networkrulesetpolicy
propagate: true
longDescription: |-
### Create a nodes to pull images from authorized registries rule
This recipe will create an External Network and Network Ruleset Policy to
allow outgoing traffic from authorized registries to pull images.
template: |-
{{`
APIVersion: 1
data:
externalnetworks:
- name: authorized_registries
description: "External network automatically created by an Out of Box template."
propagate: true
entries:
{{- range $_, $network := .Values.networks }}
- {{ $network | quote }}
{{- end }}
associatedTags:
- "externalnetwork:name=authorized_registries"
networkrulesetpolicies:
- name: authorized_registries
description: "Ruleset automatically created by an Out of Box template."
propagate: true
subject:
- - "$identity=processingunit"
- "app:host:type=kubernetes"
{{- range $_, $orgmeta := .Aporeto.OrganizationalMetadata }}
- {{ $orgmeta | quote }}
{{- end }}
outgoingRules:
- action: Allow
protocolPorts:
- any
object:
- - "externalnetwork:name=authorized_registries"
`}}
steps:
- name: General
description: General configuration
parameters:
- key: networks
name: Networks
description: Describe the external network.
longDescription: |-
Provide at least one CIDR or FQDN. Example 52.17.12.0/16,google.com
type: StringSlice