diff --git a/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx b/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx index c0070df513..e4297e4cae 100644 --- a/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx +++ b/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx @@ -87,42 +87,55 @@ You need to do the following: kubectl get pods -n ``` -1. If your cluster enforces a [global default deny policy](../../network-policy/beginners/kubernetes-default-deny.mdx), apply a network policy in the `Gateway` namespace that lets the proxy pods reach the gateway controller, the Kubernetes API server, and DNS. - Without it, the proxy cannot start. +1. If your cluster enforces a [global default deny policy](../../network-policy/beginners/kubernetes-default-deny.mdx), you do not need to allow the proxy's own traffic to the gateway controller or to DNS. + The Tigera Operator creates a `GlobalNetworkPolicy` named `calico-system.envoy-gateway-proxy` that lets clients reach the proxy, and lets the proxy reach DNS and the gateway controller. + + You do still need two things. + First, the proxy pod runs a log collector that talks to the Kubernetes API server. + Second, the proxy needs to reach your backend workloads. + Until you allow the backend hop, the gateway accepts the request and then returns `503`, because the proxy cannot open a connection to the backend. + + Apply a network policy in the `Gateway` namespace: ```yaml apiVersion: projectcalico.org/v3 kind: NetworkPolicy metadata: - name: allow-tigera-gateway-proxy + name: default.allow-gateway-proxy-egress namespace: spec: - selector: 'app.kubernetes.io/name == "envoy"' - types: [Ingress, Egress] - ingress: - - action: Allow + tier: default + order: 10 + selector: 'k8s-app == "calico-gateway-api-proxy"' + types: [Egress] egress: - - action: Allow # DNS - protocol: UDP - destination: - namespaceSelector: 'projectcalico.org/name == "kube-system"' - selector: 'k8s-app == "kube-dns"' - ports: [53] - - action: Allow # configuration from the gateway controller - protocol: TCP - destination: - namespaceSelector: 'projectcalico.org/name == "calico-system"' - selector: 'app.kubernetes.io/name == "gateway-helm"' - ports: [18000] - action: Allow # Kubernetes API server protocol: TCP destination: services: name: kubernetes namespace: default + - action: Allow # your backend workloads + destination: + selector: '' + --- + apiVersion: projectcalico.org/v3 + kind: NetworkPolicy + metadata: + name: default.allow-backend-from-gateway-proxy + namespace: + spec: + tier: default + order: 10 + selector: '' + types: [Ingress] + ingress: + - action: Allow + source: + selector: 'k8s-app == "calico-gateway-api-proxy"' ``` - Replace `` with the namespace where you created the `Gateway`. - Add egress rules for your own backends as needed. + Replace `` with the namespace where you created the `Gateway`, and `` with a selector that matches your backend pods. + Put these policies in a tier that comes after `calico-system`, at an `order` lower than your default-deny policy. 1. Create a gateway routing resource that refers to your `Gateway` resource as `.spec.parentRefs`: diff --git a/calico/networking/ingress-gateway/create-ingress-gateway.mdx b/calico/networking/ingress-gateway/create-ingress-gateway.mdx index 782955b2bb..f4c76e3698 100644 --- a/calico/networking/ingress-gateway/create-ingress-gateway.mdx +++ b/calico/networking/ingress-gateway/create-ingress-gateway.mdx @@ -81,36 +81,46 @@ You need to do the following: kubectl get pods -n ``` -1. If your cluster enforces a [global default deny policy](../../network-policy/get-started/kubernetes-default-deny.mdx), apply a network policy in the `Gateway` namespace that lets the proxy pods reach the gateway controller and DNS. - Without it, the proxy cannot start. +1. If your cluster enforces a [global default deny policy](../../network-policy/get-started/kubernetes-default-deny.mdx), you do not need to allow the proxy's own traffic. + The Tigera Operator creates a `GlobalNetworkPolicy` named `calico-system.envoy-gateway-proxy` that lets clients reach the proxy, and lets the proxy reach DNS and the gateway controller. + + You do still need to allow the proxy to reach your backend workloads. + Until you do, the gateway accepts the request and then returns `503`, because the proxy cannot open a connection to the backend. + Apply a network policy in the `Gateway` namespace that allows both directions of that hop: ```yaml apiVersion: projectcalico.org/v3 kind: NetworkPolicy metadata: - name: allow-tigera-gateway-proxy + name: default.allow-gateway-proxy-to-backend namespace: spec: - selector: 'app.kubernetes.io/name == "envoy"' - types: [Ingress, Egress] - ingress: - - action: Allow + tier: default + order: 10 + selector: 'k8s-app == "calico-gateway-api-proxy"' + types: [Egress] egress: - - action: Allow # DNS - protocol: UDP - destination: - namespaceSelector: 'projectcalico.org/name == "kube-system"' - selector: 'k8s-app == "kube-dns"' - ports: [53] - - action: Allow # configuration from the gateway controller - protocol: TCP + - action: Allow destination: - namespaceSelector: 'projectcalico.org/name == "calico-system"' - selector: 'app.kubernetes.io/name == "gateway-helm"' - ports: [18000] + selector: '' + --- + apiVersion: projectcalico.org/v3 + kind: NetworkPolicy + metadata: + name: default.allow-backend-from-gateway-proxy + namespace: + spec: + tier: default + order: 10 + selector: '' + types: [Ingress] + ingress: + - action: Allow + source: + selector: 'k8s-app == "calico-gateway-api-proxy"' ``` - Replace `` with the namespace where you created the `Gateway`. - Add egress rules for your own backends as needed. + Replace `` with the namespace where you created the `Gateway`, and `` with a selector that matches your backend pods. + Put these policies in a tier that comes after `calico-system`, at an `order` lower than your default-deny policy. 1. Create a gateway routing resource that refers to your `Gateway` resource as `.spec.parentRefs`: