From 77fc8f60279447f322b31adf4a8e9ff4491634b6 Mon Sep 17 00:00:00 2001 From: Seth Malaki Date: Wed, 19 Aug 2026 11:43:55 +0100 Subject: [PATCH] docs(gateway): trim default-deny policy to what the operator does not cover https://github.com/tigera/docs/pull/2873 replaced the obsolete tigera-gateway namespace exclusion with a reference NetworkPolicy that users apply in each Gateway namespace. That policy allows DNS and the gateway controller hop itself. With https://github.com/tigera/operator/pull/4970 the operator renders calico-system.envoy-gateway-proxy, which already allows inbound traffic to the proxy plus proxy egress to DNS and to the controller on 18000 and 18002. The reference policy would duplicate rules the operator now owns. What the operator's policy deliberately does not cover is the backend hop. It ends its egress rules with a Pass so the user keeps control of which backends the proxy may reach. Under default deny that hop stays denied, and the gateway returns 503 after the upstream connect timeout. So the step now covers only the user's part: - proxy egress to the backend, and backend ingress from the proxy. Both are needed, because default deny applies to the backend pod too. - on Enterprise, egress to the Kubernetes API server, for the log collector that runs in the proxy pod. The example selects proxies by k8s-app == "calico-gateway-api-proxy", the Calico-owned label that #4970 stamps on the proxy pod template. --- .../create-ingress-gateway.mdx | 55 ++++++++++++------- .../create-ingress-gateway.mdx | 50 ++++++++++------- 2 files changed, 64 insertions(+), 41 deletions(-) diff --git a/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx b/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx index c0070df513..e4297e4cae 100644 --- a/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx +++ b/calico-enterprise/networking/ingress-gateway/create-ingress-gateway.mdx @@ -87,42 +87,55 @@ You need to do the following: kubectl get pods -n ``` -1. If your cluster enforces a [global default deny policy](../../network-policy/beginners/kubernetes-default-deny.mdx), apply a network policy in the `Gateway` namespace that lets the proxy pods reach the gateway controller, the Kubernetes API server, and DNS. - Without it, the proxy cannot start. +1. If your cluster enforces a [global default deny policy](../../network-policy/beginners/kubernetes-default-deny.mdx), you do not need to allow the proxy's own traffic to the gateway controller or to DNS. + The Tigera Operator creates a `GlobalNetworkPolicy` named `calico-system.envoy-gateway-proxy` that lets clients reach the proxy, and lets the proxy reach DNS and the gateway controller. + + You do still need two things. + First, the proxy pod runs a log collector that talks to the Kubernetes API server. + Second, the proxy needs to reach your backend workloads. + Until you allow the backend hop, the gateway accepts the request and then returns `503`, because the proxy cannot open a connection to the backend. + + Apply a network policy in the `Gateway` namespace: ```yaml apiVersion: projectcalico.org/v3 kind: NetworkPolicy metadata: - name: allow-tigera-gateway-proxy + name: default.allow-gateway-proxy-egress namespace: spec: - selector: 'app.kubernetes.io/name == "envoy"' - types: [Ingress, Egress] - ingress: - - action: Allow + tier: default + order: 10 + selector: 'k8s-app == "calico-gateway-api-proxy"' + types: [Egress] egress: - - action: Allow # DNS - protocol: UDP - destination: - namespaceSelector: 'projectcalico.org/name == "kube-system"' - selector: 'k8s-app == "kube-dns"' - ports: [53] - - action: Allow # configuration from the gateway controller - protocol: TCP - destination: - namespaceSelector: 'projectcalico.org/name == "calico-system"' - selector: 'app.kubernetes.io/name == "gateway-helm"' - ports: [18000] - action: Allow # Kubernetes API server protocol: TCP destination: services: name: kubernetes namespace: default + - action: Allow # your backend workloads + destination: + selector: '' + --- + apiVersion: projectcalico.org/v3 + kind: NetworkPolicy + metadata: + name: default.allow-backend-from-gateway-proxy + namespace: + spec: + tier: default + order: 10 + selector: '' + types: [Ingress] + ingress: + - action: Allow + source: + selector: 'k8s-app == "calico-gateway-api-proxy"' ``` - Replace `` with the namespace where you created the `Gateway`. - Add egress rules for your own backends as needed. + Replace `` with the namespace where you created the `Gateway`, and `` with a selector that matches your backend pods. + Put these policies in a tier that comes after `calico-system`, at an `order` lower than your default-deny policy. 1. Create a gateway routing resource that refers to your `Gateway` resource as `.spec.parentRefs`: diff --git a/calico/networking/ingress-gateway/create-ingress-gateway.mdx b/calico/networking/ingress-gateway/create-ingress-gateway.mdx index 782955b2bb..f4c76e3698 100644 --- a/calico/networking/ingress-gateway/create-ingress-gateway.mdx +++ b/calico/networking/ingress-gateway/create-ingress-gateway.mdx @@ -81,36 +81,46 @@ You need to do the following: kubectl get pods -n ``` -1. If your cluster enforces a [global default deny policy](../../network-policy/get-started/kubernetes-default-deny.mdx), apply a network policy in the `Gateway` namespace that lets the proxy pods reach the gateway controller and DNS. - Without it, the proxy cannot start. +1. If your cluster enforces a [global default deny policy](../../network-policy/get-started/kubernetes-default-deny.mdx), you do not need to allow the proxy's own traffic. + The Tigera Operator creates a `GlobalNetworkPolicy` named `calico-system.envoy-gateway-proxy` that lets clients reach the proxy, and lets the proxy reach DNS and the gateway controller. + + You do still need to allow the proxy to reach your backend workloads. + Until you do, the gateway accepts the request and then returns `503`, because the proxy cannot open a connection to the backend. + Apply a network policy in the `Gateway` namespace that allows both directions of that hop: ```yaml apiVersion: projectcalico.org/v3 kind: NetworkPolicy metadata: - name: allow-tigera-gateway-proxy + name: default.allow-gateway-proxy-to-backend namespace: spec: - selector: 'app.kubernetes.io/name == "envoy"' - types: [Ingress, Egress] - ingress: - - action: Allow + tier: default + order: 10 + selector: 'k8s-app == "calico-gateway-api-proxy"' + types: [Egress] egress: - - action: Allow # DNS - protocol: UDP - destination: - namespaceSelector: 'projectcalico.org/name == "kube-system"' - selector: 'k8s-app == "kube-dns"' - ports: [53] - - action: Allow # configuration from the gateway controller - protocol: TCP + - action: Allow destination: - namespaceSelector: 'projectcalico.org/name == "calico-system"' - selector: 'app.kubernetes.io/name == "gateway-helm"' - ports: [18000] + selector: '' + --- + apiVersion: projectcalico.org/v3 + kind: NetworkPolicy + metadata: + name: default.allow-backend-from-gateway-proxy + namespace: + spec: + tier: default + order: 10 + selector: '' + types: [Ingress] + ingress: + - action: Allow + source: + selector: 'k8s-app == "calico-gateway-api-proxy"' ``` - Replace `` with the namespace where you created the `Gateway`. - Add egress rules for your own backends as needed. + Replace `` with the namespace where you created the `Gateway`, and `` with a selector that matches your backend pods. + Put these policies in a tier that comes after `calico-system`, at an `order` lower than your default-deny policy. 1. Create a gateway routing resource that refers to your `Gateway` resource as `.spec.parentRefs`: