networkPolicy¶
NetworkPolicy for the API pods. It takes effect only with a network plugin that enforces
NetworkPolicy; other plugins accept the object and ignore it.
Type: object
Path: networkPolicy
enabled¶
Admit only ingress.from and this release's own pods to the API port
Default: false
Type: boolean
Path: networkPolicy.enabled
ingress¶
Type: object
Path: networkPolicy.ingress
from¶
NetworkPolicy peers allowed to reach the API port, such as the ingress controller,
gateway, clients and Prometheus. Empty admits only this release's pods, including its
helm test pod.
Default: []
Type: list
Path: networkPolicy.ingress.from
egress¶
Type: object
Path: networkPolicy.egress
enabled¶
Also restrict API egress to DNS, the Kubernetes API, Spark driver UIs (port 4040) in the
API's namespaces, the History Server, this release's pods and extraRules
Default: false
Type: boolean
Path: networkPolicy.egress.enabled
kubernetesApi¶
Type: object
Path: networkPolicy.egress.kubernetesApi
to¶
Peers for the Kubernetes API server, normally ipBlock CIDRs of the endpoints of the
default/kubernetes Service. Empty allows no API server access through this policy.
Default: []
Type: list
Path: networkPolicy.egress.kubernetesApi.to
ports¶
API server ports; most plugins match the endpoint port after Service translation
Type: list
Path: networkPolicy.egress.kubernetesApi.ports
0¶
Default: 443
Type: number
Path: networkPolicy.egress.kubernetesApi.ports.0
1¶
Default: 6443
Type: number
Path: networkPolicy.egress.kubernetesApi.ports.1
dns¶
Type: object
Path: networkPolicy.egress.dns
to¶
Peers for DNS on port 53; empty allows port 53 to any destination
Type: list
Path: networkPolicy.egress.dns.to
0¶
Type: object
Path: networkPolicy.egress.dns.to.0
matchLabels¶
Type: object
Path: networkPolicy.egress.dns.to.0.matchLabels
kubernetes.io/metadata.name¶
Default: kube-system
Type: string
Path: networkPolicy.egress.dns.to.0.matchLabels.kubernetes.io/metadata.name
1¶
Type: object
Path: networkPolicy.egress.dns.to.1
matchLabels¶
Type: object
Path: networkPolicy.egress.dns.to.1.matchLabels
k8s-app¶
Default: kube-dns
Type: string
Path: networkPolicy.egress.dns.to.1.matchLabels.k8s-app
extraRules¶
Additional NetworkPolicy egress rules, such as a cluster selected by SPARK_ON_K8S_CONFIG_FILE
Default: []
Type: list
Path: networkPolicy.egress.extraRules