Policy to enforce NetworkPolicy at Pod level (Calico) ?

[R-Nabil]

Hi,

Is it possible with kyverno to enforce the creation of NetworkPolicy for each Pod ?
I've seen it done for Namespace, but cant figure it out for pods.

Thanks

[chipzoller]

It's technically possible but depends on how you'd want it checked and done.

[R-Nabil]

I'm basically interested by an audit type. I'm using this at home as a way to create check list of what I need to do with regards to what I think are best practices

[chipzoller]

You could probably compare all Pods' labels matched against the podSelector of a NetworkPolicy and see if any match. That would be about as much as you could realistically do.

[R-Nabil]

Would you have an example or some hints on how to do that ? My pods actually have a required label:key that will be used to match network policy so it might end up being realistic to do it that way

…

On Mon, Mar 18, 2024 at 8:23 PM Chip Zoller ***@***.***> wrote: You could probably compare all Pods' labels matched against the podSelector of a NetworkPolicy and see if any match. That would be about as much as you could realistically do. — Reply to this email directly, view it on GitHub <#9917 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQARXXQAEGWF23WEB7BQZXDYY3ME7AVCNFSM6AAAAABE2W6J6WVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DQMRXGIYDC> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[chipzoller]

https://github.com/kyverno/policies/blob/c1e882a748b0f6a9a0c38af7aaeed78c612f1fff/other/require-netpol/require-netpol.yaml#L36