examples: Extensive host policy for GKE
examples: Extensive host policy for GKE

This new example of a host policy is specific to GKE. In the same way as
the existing lock-down-dev-vms.yaml policy, it attempts to whitelist
necessary connections in the most fined-grained way possible for the
connectivity checks to work.

This example was tested with Cilium deployed as follows. No unexpected
packet drops happened while the policy was deployed.

gcloud beta container clusters create --zone europe-west4-a paul-cluster \
  --num-nodes 2 --release-channel rapid --image-type COS \
  --machine-type n1-standard-4
helm install cilium ./cilium \
  --namespace kube-system \
  --set global.nodeinit.enabled=true \
  --set nodeinit.reconfigureKubelet=true \
  --set nodeinit.removeCbrBridge=true \
  --set global.cni.binPath=/home/kubernetes/bin \
  --set config.ipam=kubernetes \
  --set global.nativeRoutingCIDR=$NATIVE_CIDR \
  --set global.hostFirewall=true \
  --set global.tunnel=disabled \
  --set config.blacklistConflictingRoutes=false \
  --set config.bpfMasquerade=false \
  --set global.masquerade=false \
  --set global.kubeProxyReplacement=strict \
  --set nodeinit.restartPods=true

All these options are needed because we can't use global.gke.enabled as
it enables per-endpoint routes which are not compatible with the host
firewall at the moment.

I also tested with remote-node identity disabled, by updating the policy
with appropriate toCIDR and fromCIDR rules. I can't assume any IPs for
nodes so the committed policy example doesn't support
enable-remote-node-identity=false.

Signed-off-by: Paul Chaignon <a027184a55211cd23e3f3094f1fdc728df5e0500@cilium.io>

cilium-team/cilium,tklauser/cilium,cilium/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,cilium-team/cilium,cilium/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,cilium/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,tgraf/cilium,michi-covalent/cilium