ce7cb702218693d08ea6d83464d2457c9250027c

services/mirrored-image/k8s/bootstrap/access.yaml

@@ -0,0 +1,148 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mirror-bootstrap
+  namespace: mirrored-image
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: mirror-bootstrap
+      app.kubernetes.io/instance: mirrored-image
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+    - toEntities: [kube-apiserver]
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+            app.kubernetes.io/name: vault
+            component: server
+      toPorts:
+        - ports:
+            - {port: "8200", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel
+      toPorts:
+        - ports:
+            - {port: "8080", protocol: TCP}
+    - toCIDR: [10.108.252.250/32]
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: quay
+            app: quay
+      toPorts:
+        - ports:
+            - {port: "8443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mirror-bootstrap
+  namespace: vault
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vault
+      component: server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mirrored-image
+            app.kubernetes.io/name: mirror-bootstrap
+            app.kubernetes.io/instance: mirrored-image
+      toPorts:
+        - ports:
+            - {port: "8200", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mirror-bootstrap
+  namespace: zitadel
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: zitadel
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mirrored-image
+            app.kubernetes.io/name: mirror-bootstrap
+            app.kubernetes.io/instance: mirrored-image
+      toPorts:
+        - ports:
+            - {port: "8080", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mirror-bootstrap
+  namespace: quay
+spec:
+  endpointSelector:
+    matchLabels:
+      app: quay
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mirrored-image
+            app.kubernetes.io/name: mirror-bootstrap
+            app.kubernetes.io/instance: mirrored-image
+      toPorts:
+        - ports:
+            - {port: "8443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: mirror-boot-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mirrored-image
+            app.kubernetes.io/name: mirror-bootstrap
+            app.kubernetes.io/instance: mirrored-image
+      toPorts:
+        - ports:
+            - {port: "32768", endPort: 60999, protocol: TCP}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mirror-login-key
+  namespace: zitadel
+rules:
+  - apiGroups: [""]
+    resources: [secrets]
+    resourceNames: [zitadel-login-service-key]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mirror-login-key
+  namespace: zitadel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mirror-login-key
+subjects:
+  - kind: ServiceAccount
+    name: mirror-bootstrap
+    namespace: mirrored-image