From 7f3c2f25e8dc539baf5405c48a298ac506dd48bc Mon Sep 17 00:00:00 2001
From: ArchiFleKs <lefevre.kevin@gmail.com>
Date: Wed, 12 Jun 2019 17:29:09 +0200
Subject: [PATCH] feat: add network policy output

---
 terraform/modules/eks/outputs.tf | 62 ++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/terraform/modules/eks/outputs.tf b/terraform/modules/eks/outputs.tf
index cae6fb5b..6ab7d560 100644
--- a/terraform/modules/eks/outputs.tf
+++ b/terraform/modules/eks/outputs.tf
@@ -802,6 +802,64 @@ spec:
 CNI_METRICS_HELPER
 }
 
+  kube_system_network_policies = <<KUBE_SYSTEM_NETWORK_POLICIES
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: kube-system
+spec:
+  podSelector: {}
+  policyTypes: 
+  - Ingress
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-internal
+  namespace: kube-system
+spec:
+  podSelector: {}
+  ingress:
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            name: kube-system
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-monitoring
+  namespace: kube-system
+spec:
+  podSelector: {}
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: monitoring
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-coredns
+  namespace: kube-system
+spec:
+  podSelector:
+    matchLabels:
+      k8s-app: coredns
+  ingress:
+  - from:
+    - namespaceSelector: {}
+    - podSelector: {}
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+KUBE_SYSTEM_NETWORK_POLICIES
+
 output "config_map_aws_auth" {
   value = "${local.config_map_aws_auth}"
 }
@@ -821,3 +879,7 @@ output "calico_yaml" {
 output "cni_metrics_helper_yaml" {
   value = "${local.cni_metrics_helper_yaml}"
 }
+
+output "kube_system_network_policies" {
+  value = "${local.kube_system_network_policies}"
+}