11.4. 为操作对象配置网络策略

流程

1. 运行以下命令来编辑 ExternalSecretsConfig CR：

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

   Copy to Clipboard Toggle word wrap

2. 通过编辑 networkPolicies 部分来设置策略：

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - name: allow-external-secrets-egress
           componentName: CoreController
           egress: # Allow all egress traffic

   Copy to Clipboard Toggle word wrap

流程

1. 运行以下命令来编辑 ExternalSecretsConfig CR：

   $ oc edit externalsecretsconfigs.operator.openshift.io cluster

   Copy to Clipboard Toggle word wrap

2. 通过编辑 networkPolicies 部分来设置策略。以下示例演示了如何允许到 Amazon Web Services (AWS)端点的出口。

   apiVersion: operator.openshift.io/v1alpha1
   kind: ExternalSecretsConfig
   metadata:
     name: cluster
   spec:
     controllerConfig:
       networkPolicies:
         - componentName: ExternalSecretsCoreController
           egress:
             # Allow egress to Kubernetes API server, AWS endpoints, and DNS
             - ports:
                 - port: 443   # HTTPS (AWS Secrets Manager)
                   protocol: TCP
         - name: allow-external-secrets-egress

   Copy to Clipboard Toggle word wrap

   componentName

   指定为 ExternalSecretsCoreController 的核心控制器的名称。