How dmitriy-zhuravel/cilium-strict-policies works
This repository is a declarative Cilium policy collection, not an application runtime. An operator applies the cluster and host policy manifests; Cilium enforces the resulting traffic rules. The README documents the main policy responsibilities, but no YAML excerpts were available to verify additional selectors or individual rule wiring.
Main entry points: etcd.yaml etcd traffic · vxlan.yaml VXLAN traffic · icmp.yaml ICMP probes · kube-api.yaml API and kubelet
Components 15
Cluster policies
- Cluster policy set
cluster-policies - etcd traffic
cluster-policies/etcd.yaml - VXLAN traffic
cluster-policies/vxlan.yaml - ICMP probes
cluster-policies/icmp.yaml - API and kubelet
cluster-policies/kube-api.yaml - Hubble traffic
cluster-policies/hubble.yaml - Cilium health
cluster-policies/health.yaml - CoreDNS traffic
cluster-policies/coredns.yaml
Host policies
- Host policy set
host-policies - SSH access
host-policies/ssh.yaml - NTP sync
host-policies/ntp.yaml - Host DNS
host-policies/dns.yaml - Package updates
host-policies/updates.yaml
Other components
- Cluster operator
- Cilium enforcement
Connections 13
- Cluster operator → Cluster policy set: applies
- Cluster operator → Host policy set: applies
- etcd traffic → Cilium enforcement: governs traffic
- VXLAN traffic → Cilium enforcement: governs traffic
- ICMP probes → Cilium enforcement: governs traffic
- API and kubelet → Cilium enforcement: governs traffic
- Hubble traffic → Cilium enforcement: governs traffic
- Cilium health → Cilium enforcement: governs traffic
- CoreDNS traffic → Cilium enforcement: governs traffic
- SSH access → Cilium enforcement: governs traffic
- NTP sync → Cilium enforcement: governs traffic
- Host DNS → Cilium enforcement: governs traffic
- Package updates → Cilium enforcement: governs traffic