Skip to content

Network policies

This package renders Kubernetes NetworkPolicies through bb-common. The package default is networkPolicies.enabled: true, even though the library itself defaults to false. The umbrella supplies environment-specific inputs and user overlays can change the effective controls. See package values and the locked bb-common network-policy reference.

Workload-specific traffic

The package declares Elasticsearch ingress on 9200 for Kibana in logging, the ECK Operator, Fluent Bit, Mattermost, and a legacy Jaeger source. It declares Kibana ingress on 5601 for ECK Operator and exporter ingress on 9108 for Prometheus. These declarations permit traffic; they do not install those clients. The umbrella conditions Fluent Bit/Mattermost/Prometheus access on the selected integrations. Custom releases or namespaces must review selectors, especially the hardcoded logging Kibana source and default bootstrap Secret references.

Shared defaults include deny-all baselines plus in-namespace access, DNS egress, and mode-dependent Istio control-plane/metrics allowances. routes.inbound adds gateway access when its API and feature conditions are met. Do not equate an explicit rule list with the total effective allowed traffic.

External destinations

The package overrides the kubeAPI destination definition to 0.0.0.0/0; bb-common excludes the metadata endpoint from generated IP-block egress by default. A definition alone is not an egress grant. The umbrella can supply narrower control-plane inputs. Review rendered rules against your actual API address.

The umbrella’s SSO mapping adds Elasticsearch egress to the global sso definition when umbrella SSO is enabled. Additional IdPs or snapshot destinations need their own reviewed egress destinations. Configure package rules under networkPolicies.egress.from / ingress.to; do not broadly disable policies or allow all Internet egress to resolve a connection error. In an umbrella v1 overlay, these parents live under packages.elasticsearchKibana.values.networkPolicies.

Mesh registration is a separate concern: a sidecar ServiceEntry for an external HTTPS host does not by itself grant Kubernetes NetworkPolicy egress to its IPs. See OIDC and mesh security.