ce7cb702218693d08ea6d83464d2457c9250027c

services/pg-image/k8s/network-policy.yaml

@@ -0,0 +1,94 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: pg-image-toolchain
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - {matchName: packages.wolfi.dev}
+              - {matchName: ghcr.io}
+              - {matchName: pkg-containers.githubusercontent.com}
+              - {matchName: github.com}
+              - {matchName: release-assets.githubusercontent.com}
+              - {matchName: packagecloud.io}
+              - {matchName: d3fo0g5hm7lbuv.cloudfront.net}
+              - {matchName: apt.postgresql.org}
+    - toFQDNs:
+        - {matchName: packages.wolfi.dev}
+        - {matchName: ghcr.io}
+        - {matchName: pkg-containers.githubusercontent.com}
+        - {matchName: github.com}
+        - {matchName: release-assets.githubusercontent.com}
+        - {matchName: packagecloud.io}
+        - {matchName: d3fo0g5hm7lbuv.cloudfront.net}
+        - {matchName: apt.postgresql.org}
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: publish
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: pg-image-publish
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - {matchName: zot.quorate.internal}
+    - toCIDR: [172.28.129.182/32]
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zot
+            app.kubernetes.io/name: zot
+            app.kubernetes.io/instance: zot
+      toPorts:
+        - ports:
+            - {port: "5000", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: zot-in
+  namespace: zot
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: zot
+      app.kubernetes.io/instance: zot
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+            delivery.quorate.dev/stage: pg-image-publish
+      toPorts:
+        - ports:
+            - {port: "5000", protocol: TCP}