konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

network-policies(crowdsec): allow all ICMP types ingress

Browse Source 
Ingress-only ns. ICMP allow added to the existing ingress section
only — adding an egress section to an ingress-only CNP transitions
it to egress-enforced mode and was the cause of attempt 66dbe9f's
DNS/apiserver/world-egress breakage.
This commit is contained in:
k.renner
2026-05-20 16:14:25 +02:00
parent 5f75fdf301
commit 9908183f18
1 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/infrastructure/network-policies/crowdsec-ns.yaml
+50
View File
@@ -23,3 +23,53 @@ spec:
- fromEntities:
- host
- remote-node
# ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
# home-assistant-ns.yaml for the rationale. INGRESS ONLY: do NOT
# add an egress section to this CNP — that's what broke attempt
# 66dbe9f (it transitioned this ns from default-allow egress to
# egress-enforced-with-only-ICMP, killing DNS / apiserver / world).
- fromEndpoints:
- matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
icmps:
- fields:
- { type: 0, family: IPv4 }
- { type: 3, family: IPv4 }
- { type: 4, family: IPv4 }
- { type: 5, family: IPv4 }
- { type: 8, family: IPv4 }
- { type: 9, family: IPv4 }
- { type: 10, family: IPv4 }
- { type: 11, family: IPv4 }
- { type: 12, family: IPv4 }
- { type: 13, family: IPv4 }
- { type: 14, family: IPv4 }
- { type: 15, family: IPv4 }
- { type: 16, family: IPv4 }
- { type: 17, family: IPv4 }
- { type: 18, family: IPv4 }
- { type: 30, family: IPv4 }
- { type: 1, family: IPv6 }
- { type: 2, family: IPv6 }
- { type: 3, family: IPv6 }
- { type: 4, family: IPv6 }
- { type: 128, family: IPv6 }
- { type: 129, family: IPv6 }
- { type: 130, family: IPv6 }
- { type: 131, family: IPv6 }
- { type: 132, family: IPv6 }
- { type: 133, family: IPv6 }
- { type: 134, family: IPv6 }
- { type: 135, family: IPv6 }
- { type: 136, family: IPv6 }
- { type: 137, family: IPv6 }
- { type: 138, family: IPv6 }
- { type: 141, family: IPv6 }
- { type: 142, family: IPv6 }
- { type: 143, family: IPv6 }
- { type: 148, family: IPv6 }
- { type: 149, family: IPv6 }
- { type: 151, family: IPv6 }
- { type: 152, family: IPv6 }
- { type: 153, family: IPv6 }