Add Calico and Cilium Network Policy samples - #5
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Adds new network policy sample content under policies/ by packaging official Cilium and Calico tutorials as reproducible YAML manifests plus helper scripts.
Changes:
- Added Cilium ingress tutorial demo app + L3/L4 and L3/L4/L7 CiliumNetworkPolicy manifests with step-by-step kubectl/cilium scripts.
- Added Cilium egress DNS/FQDN policy tutorial manifests (matchName/matchPattern/ports) with step-by-step scripts.
- Added Calico policy tutorial manifests (demo workloads + default-deny + allow rules) and scripts to apply/verify/cleanup.
Reviewed changes
Copilot reviewed 41 out of 44 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
| policies/cilium/ingress-tutorial/sw-l3-l4-policy.yaml | Cilium ingress L3/L4 policy manifest (Death Star demo). |
| policies/cilium/ingress-tutorial/sw-l3-l4-l7-policy.yaml | Cilium ingress L3/L4/L7 HTTP policy manifest (restrict method/path). |
| policies/cilium/ingress-tutorial/http-sw-app.yaml | Star Wars demo workloads (Service/Deployment/Pods) for ingress tutorial. |
| policies/cilium/ingress-tutorial/10-get-policy.sh | Helper script to fetch the applied CiliumNetworkPolicy YAML. |
| policies/cilium/ingress-tutorial/09-call-deathstar-methods-from-tiefighter.sh | Helper script to exercise allowed/denied HTTP calls under L7 policy. |
| policies/cilium/ingress-tutorial/08-create-l3-l4-l7-policy.sh | Helper script to apply the L3/L4/L7 policy manifest. |
| policies/cilium/ingress-tutorial/07-create-l3-l4-policy.sh | Helper script to apply the L3/L4 policy manifest. |
| policies/cilium/ingress-tutorial/06-call-other-web-method.sh | Helper script to call the alternate demo endpoint (PUT). |
| policies/cilium/ingress-tutorial/05-call-request-landing-web-method.sh | Helper script to call the landing endpoint (POST). |
| policies/cilium/ingress-tutorial/04-cilium-monitor.sh | Helper script to run cilium monitor on a selected node. |
| policies/cilium/ingress-tutorial/03-cilium-policy-get.sh | Helper script to run cilium policy get via an agent pod. |
| policies/cilium/ingress-tutorial/02-cilium-endpoint-list.sh | Helper script to list Cilium endpoints via agent pods per node. |
| policies/cilium/ingress-tutorial/01-deploy-demo.sh | Helper script to create namespace and deploy the ingress demo app. |
| policies/cilium/ingress-tutorial/00-install-cilium-hubble-cli.sh | Installer script for cilium + hubble CLIs. |
| policies/cilium/egress-tutorial/dns-sw-app.yaml | Egress tutorial demo pod manifest (mediabot). |
| policies/cilium/egress-tutorial/dns-port.yaml | Cilium egress DNS/FQDN policy variant that also restricts ports. |
| policies/cilium/egress-tutorial/dns-pattern.yaml | Cilium egress DNS/FQDN policy using matchPattern. |
| policies/cilium/egress-tutorial/dns-matchname.yaml | Cilium egress DNS/FQDN policy using matchName. |
| policies/cilium/egress-tutorial/07-call-services.sh | Helper script to test allowed/denied outbound connectivity. |
| policies/cilium/egress-tutorial/06-cilium-endpoint-list.sh | Helper script to list Cilium endpoints for the egress demo. |
| policies/cilium/egress-tutorial/05-get-policy.sh | Helper script to fetch the applied egress CiliumNetworkPolicy YAML. |
| policies/cilium/egress-tutorial/04-create-dns-port-policy.sh | Helper script to apply the DNS+port policy variant. |
| policies/cilium/egress-tutorial/03-create-dns-pattern-policy.sh | Helper script to apply the matchPattern policy variant. |
| policies/cilium/egress-tutorial/02-create-dns-matchname-policy.sh | Helper script to apply the matchName policy variant. |
| policies/cilium/egress-tutorial/01-deploy-demo.sh | Helper script to create namespace and deploy the egress demo pod. |
| policies/cilium/egress-tutorial/00-install-cilium-hubble-cli.sh | Installer script for cilium + hubble CLIs (egress tutorial copy). |
| policies/calico/calico-policy-tutorial/demo.yaml | Calico tutorial demo workloads (namespace, nginx, service, access pod). |
| policies/calico/calico-policy-tutorial/default-deny.yaml | Calico GlobalNetworkPolicy default-deny manifest. |
| policies/calico/calico-policy-tutorial/allow-nginx-ingress.yaml | Calico NetworkPolicy to allow ingress to nginx from access pod. |
| policies/calico/calico-policy-tutorial/allow-busybox-egress.yaml | Calico NetworkPolicy to allow egress from access pod. |
| policies/calico/calico-policy-tutorial/10-cleanup.sh | Cleanup script to remove Calico policies and demo namespace. |
| policies/calico/calico-policy-tutorial/09-get-policies.sh | Script to list/show Calico policies (global + namespaced). |
| policies/calico/calico-policy-tutorial/08-verify-ingress-allowed.sh | Script verifying nginx + internet access after ingress+egress allow. |
| policies/calico/calico-policy-tutorial/07-create-allow-nginx-ingress-policy.sh | Script applying allow-nginx-ingress Calico policy. |
| policies/calico/calico-policy-tutorial/06-verify-egress-allowed.sh | Script verifying internet allowed while nginx still denied (before ingress allow). |
| policies/calico/calico-policy-tutorial/05-create-allow-busybox-egress-policy.sh | Script applying allow-busybox-egress Calico policy. |
| policies/calico/calico-policy-tutorial/04-verify-access-denied.sh | Script verifying access denied after default-deny policy. |
| policies/calico/calico-policy-tutorial/03-create-default-deny-policy.sh | Script applying default-deny GlobalNetworkPolicy. |
| policies/calico/calico-policy-tutorial/02-verify-access-allowed.sh | Script verifying baseline access allowed before any policy. |
| policies/calico/calico-policy-tutorial/01-deploy-demo.sh | Script deploying demo workloads and waiting for readiness. |
| policies/calico/calico-policy-tutorial/00-install-calicoctl.sh | Installer script for calicoctl CLI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -0,0 +1,19 @@ | |||
| #!/bin/sh | |||
| @@ -0,0 +1,19 @@ | |||
| #!/bin/sh | |||
| namespace="starwars" | ||
|
|
||
| # Connect to pods and try to land | ||
| kubectl exec mediabot -n $namespace -- curl -I -s --connect-timeout 3 --max-time 5 https://api.github.com | head -1 # The api.github.com url does not exist |
| namespace="starwars" | ||
| template="sw-l3-l4-l7-policy.yaml" | ||
|
|
||
| # Create L3\L4 rule |
| namespace="starwars" | ||
| template="sw-l3-l4-policy.yaml" | ||
|
|
||
| # Create L3\L4 rule |
Comment on lines
+3
to
+4
| metadata: | ||
| name: "rule1" |
Comment on lines
+3
to
+4
| metadata: | ||
| name: "fqdn" |
| namespace="starwars" | ||
| template="dns-matchname.yaml" | ||
|
|
||
| # Create L3\L4 rule |
| namespace="starwars" | ||
| template="dns-pattern.yaml" | ||
|
|
||
| # Create L3\L4 rule |
| namespace="starwars" | ||
| template="dns-port.yaml" | ||
|
|
||
| # Create L3\L4 rule |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
This pull requests adds scripts and YAML files built from the following official tutorials:
Changes
Scripts and YAML manifests are available under the following folders:
policies/ciliumpolicies/calico