add ingress/egress network policies

SwissDataScienceCenter · Feb 6, 2023 · 77c129f · 77c129f
1 parent 1cba78d
commit 77c129f
Show file tree

Hide file tree

Showing 2 changed files with 47 additions and 2 deletions.
diff --git a/helm-chart/renku-notebooks/templates/network-policy.yaml b/helm-chart/renku-notebooks/templates/network-policy.yaml
@@ -18,3 +18,50 @@ spec:
       ports:
         - protocol: TCP
           port: http
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "notebooks.fullname" . }}-ssh-sessions
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: jupyterserver
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: amalthea
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: {{ template "notebooks.name" . }}-ssh
+      ports:
+        - port: ssh
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "notebooks.fullname" . }}-ssh-sessions-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ template "notebooks.name" . }}-ssh
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/component: jupyterserver
+              app.kubernetes.io/instance: {{ .Release.Name }}
+              app.kubernetes.io/name: amalthea
+      ports:
+        - port: ssh
+          protocol: TCP
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
diff --git a/ssh-jump-host/sshd_config b/ssh-jump-host/sshd_config
@@ -12,8 +12,6 @@ X11Forwarding no
 PrintMotd no
 PidFile /opt/ssh/sshd.pid
 
-LogLevel DEBUG3
-
 AcceptEnv LANG LC_*
 
 Match User jovyan