ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/workflows/go-release/network-policy.yaml

@@ -0,0 +1,134 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: go-release-forgejo
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/project
+      operator: In
+      values:
+      - chultun
+      - corago
+      - zygostates
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - go-release-source
+      - go-release-publish
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: forge-git-http.forgejo-public.svc.cluster.local
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: forgejo-public
+        app.kubernetes.io/name: forgejo
+        app.kubernetes.io/instance: forge-git
+    toPorts:
+    - ports:
+      - port: '3000'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: go-release-cache
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: delivery.quorate.dev/project
+      operator: In
+      values:
+      - chultun
+      - corago
+      - zygostates
+    - key: delivery.quorate.dev/stage
+      operator: In
+      values:
+      - go-release-pull
+      - go-release-export
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: s3.quorate.internal
+  - toCIDR:
+    - 10.66.127.81/32
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: versitygw
+        app.kubernetes.io/name: versitygw
+        app.kubernetes.io/instance: versitygw
+    toPorts:
+    - ports:
+      - port: '7070'
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: go-release-tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: go-release-tools
+    matchExpressions:
+    - key: delivery.quorate.dev/project
+      operator: In
+      values:
+      - chultun
+      - corago
+      - zygostates
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchName: packages.wolfi.dev
+        - matchName: proxy.golang.org
+        - matchName: storage.googleapis.com
+        - matchName: sum.golang.org
+  - toFQDNs:
+    - matchName: packages.wolfi.dev
+    - matchName: proxy.golang.org
+    - matchName: storage.googleapis.com
+    - matchName: sum.golang.org
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP