mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-03-22 00:41:26 +00:00
d9c6fb7625
This commit enables Cilium's host firewall feature and makes use of it
to deny external connections to two exporters running as daemonset pods
in the host network namespace.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Host firewall is now enabled by default, adding an extra layer of
security.
- Enhanced network traffic management with new policies:
- One policy tightens access to critical service ports.
- Another secures monitoring endpoints by restricting unauthorized
external access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
21 lines
422 B
YAML
21 lines
422 B
YAML
cilium:
|
|
kubeProxyReplacement: true
|
|
hostFirewall:
|
|
enabled: true
|
|
hubble:
|
|
enabled: false
|
|
externalIPs:
|
|
enabled: true
|
|
nodePort:
|
|
enabled: true
|
|
loadBalancer:
|
|
algorithm: maglev
|
|
ipam:
|
|
mode: "kubernetes"
|
|
image:
|
|
repository: ghcr.io/cozystack/cozystack/cilium
|
|
tag: 1.17.1
|
|
digest: "sha256:bb2ad64dfc01f774b429a96108527740c1f08230cac4b848a4939627dfce7a4a"
|
|
envoy:
|
|
enabled: false
|