ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
259
services/mirrored-image/k8s/network-policy.yaml
Normal file
259
services/mirrored-image/k8s/network-policy.yaml
Normal file
|
|
@ -0,0 +1,259 @@
|
|||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-controller
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
io.cilium.k8s.policy.serviceaccount: mirrored-image
|
||||
egress:
|
||||
- toEntities: [kube-apiserver]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchName: registry.quorate.internal}
|
||||
- toCIDR: [10.108.252.250/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: quay
|
||||
app: quay
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-executor
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: workflows.argoproj.io/workflow
|
||||
operator: Exists
|
||||
egress:
|
||||
- toEntities: [kube-apiserver]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-prepare
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
mirror.quorate.dev/purpose: prepare
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchPattern: "*"}
|
||||
- toEntities: [world]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toCIDR: [10.108.252.250/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: quay
|
||||
app: quay
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-internal
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: mirror.quorate.dev/purpose
|
||||
operator: In
|
||||
values: [promotion, cleanup]
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchName: registry.quorate.internal}
|
||||
- toCIDR: [10.108.252.250/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: quay
|
||||
app: quay
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-prep-storage
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
io.cilium.k8s.policy.serviceaccount: candidate-exec
|
||||
mirror.quorate.dev/purpose: prepare
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: versitygw
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-prep-storage
|
||||
namespace: versitygw
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: mirrored-image
|
||||
io.cilium.k8s.policy.serviceaccount: candidate-exec
|
||||
mirror.quorate.dev/purpose: prepare
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-promotion-storage
|
||||
namespace: mirrored-image
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
mirror.quorate.dev/purpose: promotion
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- {matchName: s3.quorate.internal}
|
||||
- toCIDR: [10.66.127.81/32]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: versitygw
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-promotion-storage
|
||||
namespace: versitygw
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: mirrored-image
|
||||
io.cilium.k8s.policy.serviceaccount: promote-exec
|
||||
mirror.quorate.dev/purpose: promotion
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-quay
|
||||
namespace: quay
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: quay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [mirrored-image]
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values: [mirrored-image, candidate-exec, promote-exec, cleanup-exec]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: mirror-quay-replies
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [mirrored-image]
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values: [mirrored-image, candidate-exec, promote-exec, cleanup-exec]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "32768", endPort: 60999, protocol: TCP}
|
||||
Loading…
Reference in a new issue