ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
213
services/project-delivery/k8s/network-policy.yaml
Normal file
213
services/project-delivery/k8s/network-policy.yaml
Normal file
|
|
@ -0,0 +1,213 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes: [Ingress, Egress]
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: project-delivery-controller
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: project-delivery-controller
|
||||
egress:
|
||||
- toEntities: [kube-apiserver]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "53", protocol: UDP}
|
||||
- {port: "53", protocol: TCP}
|
||||
rules:
|
||||
dns:
|
||||
- matchName: forge-git-http.forgejo-public.svc.cluster.local
|
||||
- matchName: forgejo-http.forgejo.svc.cluster.local
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo-public
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: forgejo
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forgejo
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: workflow-executor
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: workflows.argoproj.io/workflow
|
||||
operator: Exists
|
||||
egress:
|
||||
- toEntities: [kube-apiserver]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-ingress-project-delivery-replies
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [project-delivery]
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values: [project-delivery-executor]
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: Exists
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "32768", endPort: 60999, protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: project-delivery-source
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [project-delivery]
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [remora-source, nuthatch-source, lazaret-source, lazaret-publication, go-release-source, go-release-publish, ostension-source, ostension-release, layshaft-source, layshaft-client-pub]
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: project-delivery
|
||||
io.cilium.k8s.policy.serviceaccount: project-delivery-controller
|
||||
delivery.quorate.dev/stage: controller
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: quorate-delivery-source
|
||||
namespace: forgejo
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forgejo
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [project-delivery]
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values: [project-delivery-executor]
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [quorate-source, ctrl-source, go-oci-source]
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: project-delivery
|
||||
io.cilium.k8s.policy.serviceaccount: project-delivery-controller
|
||||
delivery.quorate.dev/stage: controller
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: quorate-delivery-publication
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: forgejo
|
||||
app.kubernetes.io/instance: forge-git
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: project-delivery
|
||||
io.cilium.k8s.policy.serviceaccount: project-delivery-executor
|
||||
delivery.quorate.dev/stage: quorate-publication
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "3000", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: project-delivery-publication
|
||||
namespace: quay
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: quay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [project-delivery]
|
||||
- key: io.cilium.k8s.policy.serviceaccount
|
||||
operator: In
|
||||
values: [project-delivery-executor]
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [publish-internal, layshaft-server-pub]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "8443", protocol: TCP}
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: project-delivery-cache
|
||||
namespace: versitygw
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: versitygw
|
||||
app.kubernetes.io/instance: versitygw
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: k8s:io.kubernetes.pod.namespace
|
||||
operator: In
|
||||
values: [project-delivery]
|
||||
- key: delivery.quorate.dev/stage
|
||||
operator: In
|
||||
values: [remora-cache-pull, remora-cache-export, nuthatch-cache-pull, nuthatch-cache-export, lazaret-cache-pull, lazaret-cache-export, ctrl-cache-pull, ctrl-cache-export, go-oci-cache-pull, go-oci-cache-export, go-release-pull, go-release-export, quorate-cache-pull, quorate-cache-export, layshaft-pull, layshaft-export]
|
||||
toPorts:
|
||||
- ports:
|
||||
- {port: "7070", protocol: TCP}
|
||||
Loading…
Reference in a new issue