Cilium Network Policy for IBM StreamSets Agent

cilium-streamsets-agent.yaml

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: cnp-streamsets-agent
  namespace: <your namespace>
spec:
  endpointSelector:
    matchLabels:
      "streamsets": agent
  egress:

  # Allow egress to matched StreamSets Control Hub
  - toFQDNs:
    - matchName: <your Control Hub URL>
    toPorts:
    - ports:
      - port: "443"
        protocol: TCP

  # Allow egress to kube-dns
  - toEndpoints:
    - matchLabels:
        "k8s:io.kubernetes.pod.namespace": kube-system
        "k8s:k8s-app": kube-dns
    toPorts:
    - ports:
      - port: "53"
        protocol: UDP
      rules:
        dns:
        - matchPattern: "*"

  # Allow egress to kube-apiserver
  - toEntities:
    - kube-apiserver