299 lines
7.7 KiB
YAML
299 lines
7.7 KiB
YAML
|
---
|
||
|
|
# CNPG cluster pods: intra-namespace, host metrics, DNS.
|
||
|
|
apiVersion: cilium.io/v2
|
||
|
|
kind: CiliumNetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: postgres-cluster
|
||
|
|
namespace: postgres
|
||
|
|
spec:
|
||
|
|
endpointSelector:
|
||
|
|
matchLabels:
|
||
|
|
cnpg.io/cluster: main
|
||
|
|
ingress:
|
||
|
|
# Allow intra-namespace replication and metrics.
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: postgres
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
# Vault database engine: rotates static role credentials
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: vault
|
||
|
|
app.kubernetes.io/name: vault
|
||
|
|
component: server
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Zitadel app and init job
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: zitadel
|
||
|
|
app.kubernetes.io/name: zitadel
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Forgejo app and init containers
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: forgejo
|
||
|
|
app.kubernetes.io/name: forgejo
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: k8s:io.kubernetes.pod.namespace
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- forgejo-public
|
||
|
|
- key: app.kubernetes.io/name
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- forgejo
|
||
|
|
- key: app.kubernetes.io/instance
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- forge-code
|
||
|
|
- forge-git
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Grafana app
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: grafana
|
||
|
|
app.kubernetes.io/name: grafana
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Quay registry, mirror, and Clair
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: quay
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Argo Workflows controller/server archive and node-status offload
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: argo
|
||
|
|
app.kubernetes.io/name: argo-workflows-workflow-controller
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: argo
|
||
|
|
app.kubernetes.io/name: argo-workflows-server
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchExpressions:
|
||
|
|
- key: k8s:io.kubernetes.pod.namespace
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- stalwart
|
||
|
|
- key: app.kubernetes.io/name
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- stalwart
|
||
|
|
- stalwart-bootstrap
|
||
|
|
- stalwart-controller
|
||
|
|
- key: app.kubernetes.io/instance
|
||
|
|
operator: In
|
||
|
|
values:
|
||
|
|
- stalwart
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow host for metrics.
|
||
|
|
- fromEntities:
|
||
|
|
- host
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
egress:
|
||
|
|
# Allow intra-namespace replication and metrics.
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: postgres
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "5432"
|
||
|
|
protocol: TCP
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow kube-apiserver access.
|
||
|
|
- toEntities:
|
||
|
|
- kube-apiserver
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "6443"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow DNS access.
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
||
|
|
k8s-app: kube-dns
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "53"
|
||
|
|
protocol: UDP
|
||
|
|
- port: "53"
|
||
|
|
protocol: TCP
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: versitygw
|
||
|
|
app.kubernetes.io/name: versitygw
|
||
|
|
app.kubernetes.io/instance: versitygw
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "7070"
|
||
|
|
protocol: TCP
|
||
|
|
- toCIDR:
|
||
|
|
- 10.66.127.81/32
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "443"
|
||
|
|
protocol: TCP
|
||
|
|
---
|
||
|
|
# Host egress to postgres pods (metrics, webhook).
|
||
|
|
apiVersion: cilium.io/v2
|
||
|
|
kind: CiliumClusterwideNetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: host-egress-postgres
|
||
|
|
spec:
|
||
|
|
nodeSelector: {}
|
||
|
|
egress:
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: postgres
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
- port: "9443"
|
||
|
|
protocol: TCP
|
||
|
|
- port: "8081"
|
||
|
|
protocol: TCP
|
||
|
|
---
|
||
|
|
# CNPG operator: webhook (9443), host metrics (8000), apiserver.
|
||
|
|
apiVersion: cilium.io/v2
|
||
|
|
kind: CiliumNetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: cnpg-operator
|
||
|
|
namespace: postgres
|
||
|
|
spec:
|
||
|
|
endpointSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: cloudnative-pg
|
||
|
|
ingress:
|
||
|
|
# Allow webhook access from kube-apiserver (may arrive as remote-node when apiserver is on a different node).
|
||
|
|
- fromEntities:
|
||
|
|
- kube-apiserver
|
||
|
|
- host
|
||
|
|
- remote-node
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "9443"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow host for metrics.
|
||
|
|
- fromEntities:
|
||
|
|
- host
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
egress:
|
||
|
|
# Allow metrics scraping from cluster pods.
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
cnpg.io/cluster: main
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "8000"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow kube-apiserver access.
|
||
|
|
- toEntities:
|
||
|
|
- kube-apiserver
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "6443"
|
||
|
|
protocol: TCP
|
||
|
|
# Allow DNS access.
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
||
|
|
k8s-app: kube-dns
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "53"
|
||
|
|
protocol: UDP
|
||
|
|
- port: "53"
|
||
|
|
protocol: TCP
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: postgres
|
||
|
|
app.kubernetes.io/name: plugin-barman-cloud
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "9090"
|
||
|
|
protocol: TCP
|
||
|
|
---
|
||
|
|
apiVersion: cilium.io/v2
|
||
|
|
kind: CiliumNetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: barman
|
||
|
|
namespace: postgres
|
||
|
|
spec:
|
||
|
|
endpointSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: plugin-barman-cloud
|
||
|
|
ingress:
|
||
|
|
- fromEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: postgres
|
||
|
|
app.kubernetes.io/name: cloudnative-pg
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "9090"
|
||
|
|
protocol: TCP
|
||
|
|
- fromEntities:
|
||
|
|
- host
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "8081"
|
||
|
|
protocol: TCP
|
||
|
|
egress:
|
||
|
|
- toEntities:
|
||
|
|
- kube-apiserver
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "6443"
|
||
|
|
protocol: TCP
|
||
|
|
- toEndpoints:
|
||
|
|
- matchLabels:
|
||
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
||
|
|
k8s-app: kube-dns
|
||
|
|
toPorts:
|
||
|
|
- ports:
|
||
|
|
- port: "53"
|
||
|
|
protocol: UDP
|
||
|
|
- port: "53"
|
||
|
|
protocol: TCP
|