This message was deleted.

there is not generally any way to inject arbitrary changes into the rules generated by the CNI

I am not. That is why I ask. Due to the hosting provider I’m on, I don’t have access to a border firewall, so I want to firewall the harvester nodes, however, the tights integration of k8s as a first class citizen gives you now way of doing this obviously. I need to block all traffic coming in to the ‘mgmt-br’ interface, except what I allow. Then let calico manage the remaining iptables rules.

You can try looking at https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts , but note that Kubernetes with 0 network policies behaves like firewall is in an allow all state within the cluster, but Kubernetes with 1 or more network policy behaves like firewall is in a deny all state within the cluster for anything not covered by a network policy. I know that goes between namespaces, but don't recall what else. So you might break things trying to do that, but if you can figure out the network policies you need then you may be able to use that.

This one seems like the right one: https://docs.tigera.io/calico/latest/network-policy/hosts/kubernetes-nodes

https://docs.tigera.io/calico/latest/reference/host-endpoints/ ?

Thanks I will check

No problem and good luck getting all the holes you need.

yep. It’s a pile, but that’s OK