aqua-k8s-netpols.yaml

#Please read the README-File first
apiVersion: networking.k8s.io/v1\
kind: NetworkPolicy\
metadata:\
  name: Aqua-Cluster-NP\
  namespace: default\
spec:\
  podSelector: \{\}\
  policyTypes:\
    - Ingress\
    - Egress\
  ingress:\
    - from:\
        - podSelector: \{\}\
#Incoming traffic Aqua UI and API - Aqua Server\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-ui\
      ports:\
        - port: 8443\
          protocol: HTTPS\
#or     - port: 8080\
#         protocol: HTTP\
#Incoming traffic Aqua Gateway - Aqua Server\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-gateway\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Incoming traffic Aqua Scanner - Aqua Server\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-scanner\
      ports:\
        - port: 8443\
      protocol: HTTPS\
#or     - port: 8080\
#         protocol: HTTP\
#Incoming traffic Aqua Server - Aqua DB\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-server\
      ports:\
        - port: 5432\
      protocol: TCP\
#Incoming traffic Aqua Gateway - Aqua DB\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-gateway\
      ports:\
        - port: 5432\
      protocol: TCP\
#Incoming traffic Aqua Enforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-enforcer\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Incoming traffic MicroEnforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: micro-enforcer\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Incoming traffic Pod Enforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: pod-enforcer\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Incoming traffic VM Enforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: vm-enforcer\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Incoming traffic NanoEnforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: nano-enforcer\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Alternative       \
#       - port: 3622\
#         protocol: SSH\
#Incoming traffic KubeEnforcer - Aqua Gateway\
    - from:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: kube-enforcer\
      ports:\
        - port: 8443\
          protocol: gRPC\
#Incoming traffic Aqua Server - Aqua CyberCenter\
#If you have a on-prem configuration for the Cybercenter you can use the static-ip\
#If you have a Saas Config you can use the IPs provided in the POV Email - once provisioned\
#Please, adjust the rule before you set it active, otherwise security risks may occur.\
#   - from:\
#       - ipBlock:\
#           cidr: 0.0.0.0/0\
#     ports:\
#       - port: 443\
#     protocol: HTTPS\
  egress:\
#Allowing traffic to Kubernetes DNS\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              k8s-app: kube-dns\
      ports:\
        - port: 53\
          protocol: UDP\
#Outgoing traffic Aqua DB - Aqua Server\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-db\
      ports:\
        - port: 5432\
      protocol: TCP\
#Outgoing traffic Aqua Server - Aqua Gateway\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-server\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Outgoing traffic Aqua DB - Aqua Gateway\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-db\
      ports:\
        - port: 5432\
      protocol: TCP\
#Outgoing traffic Aqua Server - Aqua Scanner\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-server\
      ports:\
        - port: 8443\
      protocol: HTTPS\
#or     - port: 8080\
#     protocol: HTTP\
#Outgoing traffic Aqua Gateway - Aqua Enforcer, MicroEnforcer, Pod Enforcer, KubeEnforcer, VM Enforcer\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-gateway\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Outgoing traffic Aqua Gateway - Aqua NanoEnforcer\
    - to:\
        - namespaceSelector: \{\}\
          podSelector:\
            matchLabels:\
              app: aqua-gateway\
      ports:\
        - port: 8443\
      protocol: gRPC\
#Alternative Port\
#       - port: 3622\
#     protocol: SSH\
    - to:\
        - podSelector: \{\}\
#Outgoing traffic to CyberCenter - Aqua Server\
#If you have a on-prem configuration for the Cybercenter you can use the static-ip\
#If you have a Saas Config you can use the IPs provided in the POV Email - once provisioned\
#Please, adjust the rule before you set it active, otherwise security risks may occur.\
#\
#   - to:\
#       - ipBlock:\
#         cidr: 0.0.0.0/0\
#    ports:\
#       - port: 443\
#           protocol: HTTPS}