ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/workflows/go-oci/codex-bridge/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: codex-bridge-
+resources:
+  - ../base
+  - network-policy.yaml
+patches:
+  - target:
+      kind: WorkflowTemplate
+      name: build
+    patch: |-
+      - op: replace
+        path: /spec/podMetadata/labels/delivery.quorate.dev~1project
+        value: codex-bridge

services/project-delivery/k8s/workflows/go-oci/codex-bridge/network-policy.yaml

@@ -0,0 +1,37 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: codex-toolchain
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: go-oci-toolchain
+      delivery.quorate.dev/project: codex-bridge
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: github.com
+              - matchName: release-assets.githubusercontent.com
+              - matchName: packages.wolfi.dev
+              - matchName: proxy.golang.org
+              - matchName: storage.googleapis.com
+              - matchName: sum.golang.org
+    - toFQDNs:
+        - {matchName: github.com}
+        - {matchName: release-assets.githubusercontent.com}
+        - {matchName: packages.wolfi.dev}
+        - {matchName: proxy.golang.org}
+        - {matchName: storage.googleapis.com}
+        - {matchName: sum.golang.org}
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}