deploy
65 lines
1.5 KiB
YAML
65 lines
1.5 KiB
YAML
# Silo "demo" — isolamento do tenant (namespace + quota + limites + rede)
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: acme-prod
|
|
labels:
|
|
name: acme-prod
|
|
tenant: acme
|
|
athleticmap.io/tier: pilot
|
|
---
|
|
apiVersion: v1
|
|
kind: ResourceQuota
|
|
metadata:
|
|
name: tenant-quota
|
|
namespace: acme-prod
|
|
spec:
|
|
hard:
|
|
requests.cpu: "4"
|
|
requests.memory: 7Gi
|
|
limits.cpu: "8"
|
|
limits.memory: 10Gi
|
|
pods: "30"
|
|
persistentvolumeclaims: "4"
|
|
---
|
|
apiVersion: v1
|
|
kind: LimitRange
|
|
metadata:
|
|
name: defaults
|
|
namespace: acme-prod
|
|
spec:
|
|
limits:
|
|
- type: Container
|
|
default:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
defaultRequest:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: deny-cross-tenant
|
|
namespace: acme-prod
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- from:
|
|
- podSelector: {}
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
egress:
|
|
- to: # intra-namespace (pods) + ClusterIPs (VIP de service, pre-DNAT)
|
|
- podSelector: {}
|
|
- ipBlock: { cidr: 10.43.0.0/16 }
|
|
- to: # DNS (CoreDNS em kube-system)
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- { protocol: UDP, port: 53 }
|
|
- { protocol: TCP, port: 53 }
|