ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
5 changed files with 145336 additions and 0 deletions
--- a/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/kustomization.yaml
+++ b/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/kustomization.yaml
@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - workflowtemplate.yaml
--- a/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/runtime.apko.yaml
+++ b/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/runtime.apko.yaml
@ -0,0 +1,45 @@
+contents:
+  keyring:
+    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+  repositories:
+    - https://packages.wolfi.dev/os
+  packages:
+    - c-ares=1.34.8-r2
+    - ca-certificates-bundle=20261020-r0
+    - glibc-2.44=2.44-r6
+    - glibc-2.44-locale-posix=2.44-r6
+    - icu78-data-full=78.3-r3
+    - ld-linux-2.44=2.44-r6
+    - libatomic=16.2.0-r2
+    - libbrotlicommon1=1.2.0-r5
+    - libbrotlidec1=1.2.0-r5
+    - libbrotlienc1=1.2.0-r5
+    - libcrypto3=3.6.4-r5
+    - libgcc=16.2.0-r1
+    - libicu78=78.3-r3
+    - libnghttp2-14=1.70.0-r3
+    - libssl3=3.6.4-r5
+    - libstdc++=16.2.0-r1
+    - libuv=1.52.1-r2
+    - openssl-provider-legacy-allowed=4.0.2-r1
+    - wolfi-baselayout=20230201-r30
+    - zlib=1.3.2-r5
+accounts:
+  groups:
+    - groupname: application
+      gid: 65532
+  users:
+    - username: application
+      uid: 65532
+      gid: 65532
+  run-as: 65532
+entrypoint:
+  command: /usr/bin/node /app/server.js
+environment:
+  HOME: /tmp
+  NODE_ENV: production
+  PATH: /usr/bin:/bin
+  HOST: 0.0.0.0
+  PORT: "3000"
+  BODY_SIZE_LIMIT: "15728640"
+work-dir: /app
--- a/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/workflowtemplate.yaml
+++ b/services/project-delivery/k8s/workflows/hf-chat-ui/delivery/workflowtemplate.yaml
@ -0,0 +1,688 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: hf-build
+  namespace: project-delivery
+  labels:
+    app.kubernetes.io/name: project-delivery
+    app.kubernetes.io/instance: hf-chat-ui
+spec:
+  entrypoint: workflow
+  serviceAccountName: project-delivery-executor
+  automountServiceAccountToken: false
+  executor:
+    serviceAccountName: project-delivery-executor
+  parallelism: 3
+  podGC:
+    strategy: OnWorkflowCompletion
+  podMetadata:
+    annotations:
+      dev.gvisor.spec.mount.var-run-argo.share: pod
+      dev.gvisor.spec.mount.var-run-argo.type: tmpfs
+      dev.gvisor.spec.mount.var-run-argo.options: rw,rprivate
+    labels:
+      app.kubernetes.io/name: project-delivery
+      app.kubernetes.io/instance: hf-chat-ui
+      delivery.quorate.dev/project: hf-chat-ui
+  podSpecPatch: |
+    dnsConfig:
+      options:
+      - name: ndots
+        value: '1'
+    containers:
+    - name: wait
+      volumeMounts:
+      - name: exec-sa-token
+        mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+        readOnly: true
+      image: quay.io/argoproj/argoexec@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      resources:
+        requests:
+          cpu: 100m
+          memory: 64Mi
+        limits:
+          cpu: '1'
+          memory: 256Mi
+    volumes:
+    - name: exec-sa-token
+      secret: null
+      projected:
+        defaultMode: 288
+        sources:
+        - serviceAccountToken:
+            expirationSeconds: 1800
+            path: token
+        - configMap:
+            name: kube-root-ca.crt
+            items:
+            - key: ca.crt
+              path: ca.crt
+        - downwardAPI:
+            items:
+            - path: namespace
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+    initContainers:
+    - name: init
+      image: quay.io/argoproj/argoexec@sha256:28432d912a716167709429b28e2755f49416eb4754c35ca3013863fb72717a00
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+          - ALL
+        readOnlyRootFilesystem: true
+      resources:
+        requests:
+          cpu: 100m
+          memory: 64Mi
+        limits:
+          cpu: '1'
+          memory: 256Mi
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    fsGroup: 65532
+    fsGroupChangePolicy: OnRootMismatch
+    seccompProfile:
+      type: RuntimeDefault
+  arguments:
+    parameters:
+      - name: source-repository
+      - name: source-ref
+      - name: source-revision
+      - name: targets
+  templates:
+    - name: workflow
+      steps:
+        - - name: initialize
+            template: initialize
+        - - name: delivery
+            template: delivery
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{steps.initialize.outputs.parameters.working-pvc}}'
+      outputs:
+        parameters:
+          - name: delivery-result
+            valueFrom:
+              parameter: '{{steps.delivery.outputs.parameters.delivery-result}}'
+    - name: initialize
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-workspace-init
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/initialize.fsx
+        env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+          limits:
+            cpu: '1'
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /workspace
+          - name: workflow-workspace
+            mountPath: /tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: workflow-workspace
+          ephemeral:
+            volumeClaimTemplate:
+              spec:
+                accessModes:
+                  - ReadWriteOnce
+                storageClassName: openebs-hostpath-ssd
+                resources:
+                  requests:
+                    storage: 20Gi
+      outputs:
+        parameters:
+          - name: working-pvc
+            valueFrom:
+              path: /workspace/.claim-name
+    - name: delivery
+      inputs:
+        parameters:
+          - name: working-pvc
+      dag:
+        tasks:
+          - name: tools
+            template: tools
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: source-pull
+            dependencies:
+              - tools
+            template: source-pull
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: cache-pull
+            dependencies:
+              - source-pull
+            template: cache-pull
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: toolchain-pull
+            dependencies:
+              - cache-pull
+            template: toolchain-pull
+            when: "{{tasks.cache-pull.outputs.parameters.cache-origin}} == primary"
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: build
+            dependencies:
+              - cache-pull
+              - toolchain-pull
+            template: build
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: image-publish
+            dependencies:
+              - build
+            template: image-publish
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+          - name: cache-export
+            dependencies:
+              - build
+            template: cache-export
+            when: "{{tasks.cache-pull.outputs.parameters.cache-origin}} == primary"
+            continueOn:
+              failed: true
+              error: true
+            arguments:
+              parameters:
+                - name: working-pvc
+                  value: '{{inputs.parameters.working-pvc}}'
+      outputs:
+        parameters:
+          - name: delivery-result
+            valueFrom:
+              parameter: '{{tasks.image-publish.outputs.parameters.delivery-result}}'
+    - name: tools
+      inputs:
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-tools
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+        args: [/orchestration/tools.fsx]
+        resources:
+          requests: {cpu: 100m, memory: 128Mi}
+          limits: {cpu: '1', memory: 1Gi}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /workspace
+            subPath: tools
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: tools-tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+    - name: source-pull
+      inputs:
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-source
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/source.fsx
+        env:
+          - name: SOURCE_REPOSITORY
+            value: '{{workflow.parameters.source-repository}}'
+          - name: SOURCE_REVISION
+            value: '{{workflow.parameters.source-revision}}'
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: '1'
+            memory: 512Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /tools
+            subPath: tools
+            readOnly: true
+          - name: source-auth
+            mountPath: /source-auth
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /source
+            subPath: source
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: source/tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: source-auth
+          secret:
+            secretName: project-delivery-source
+            defaultMode: 288
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+    - name: cache-pull
+      outputs:
+        parameters:
+          - name: cache-origin
+            valueFrom:
+              path: /state/cache-origin
+      inputs:
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-cache-pull
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/cache.fsx
+        env:
+          - name: CACHE_ACTION
+            value: pull
+          - name: SOURCE_REVISION
+            value: '{{workflow.parameters.source-revision}}'
+        resources:
+          requests:
+            cpu: 500m
+            memory: 256Mi
+          limits:
+            cpu: '2'
+            memory: 1Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: cache-auth
+            mountPath: /cache-auth
+            readOnly: true
+          - name: cache-ca
+            mountPath: /cache-ca
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /source
+            subPath: source
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /toolchain
+            subPath: toolchain
+          - name: workflow-workspace
+            mountPath: /state
+            subPath: state
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: state/cache-tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: cache-auth
+          secret:
+            secretName: project-delivery-cache-reader
+            defaultMode: 288
+        - name: cache-ca
+          secret:
+            secretName: quay-internal-ca
+            defaultMode: 288
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+    - name: toolchain-pull
+      inputs:
+        parameters:
+          - name: working-pvc
+      podSpecPatch: |
+        runtimeClassName: gvisor
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-toolchain
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/toolchain.fsx
+        resources:
+          requests:
+            cpu: '1'
+            memory: 512Mi
+          limits:
+            cpu: '4'
+            memory: 4Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /source
+            subPath: source
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /toolchain
+            subPath: toolchain
+          - name: workflow-workspace
+            mountPath: /state
+            subPath: state
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: toolchain/tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+    - name: build
+      inputs:
+        parameters:
+          - name: working-pvc
+      podSpecPatch: |
+        runtimeClassName: gvisor
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-build
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/build.fsx
+        env:
+          - name: SOURCE_REVISION
+            value: '{{workflow.parameters.source-revision}}'
+        resources:
+          requests:
+            cpu: '2'
+            memory: 1Gi
+          limits:
+            cpu: '6'
+            memory: 8Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /source
+            subPath: source
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /toolchain
+            subPath: toolchain
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /state
+            subPath: state
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /output
+            subPath: output
+          - name: workflow-workspace
+            mountPath: /usr/bin
+            subPath: toolchain/shell/usr/bin
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: output/tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+    - name: image-publish
+      inputs:
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-publication
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/publish.fsx
+        env:
+          - name: SOURCE_REVISION
+            value: '{{workflow.parameters.source-revision}}'
+          - name: TARGETS
+            value: '{{workflow.parameters.targets}}'
+        resources:
+          requests:
+            cpu: 250m
+            memory: 256Mi
+          limits:
+            cpu: '2'
+            memory: 1Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: registry-auth
+            mountPath: /auth
+            readOnly: true
+          - name: registry-ca
+            mountPath: /registry-ca
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /handoff
+            subPath: output
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /result
+            subPath: output/result
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: output/publish-tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: registry-auth
+          secret:
+            secretName: quay-writer
+            defaultMode: 288
+        - name: registry-ca
+          secret:
+            secretName: quay-internal-ca
+            defaultMode: 288
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
+      outputs:
+        parameters:
+          - name: delivery-result
+            valueFrom:
+              path: /result/delivery-result
+    - name: cache-export
+      inputs:
+        parameters:
+          - name: working-pvc
+      metadata:
+        labels:
+          delivery.quorate.dev/stage: hf-cache-export
+      container:
+        image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+        command:
+          - /usr/share/dotnet/dotnet
+          - /opt/fsi/fsi.dll
+          - --exec
+        args:
+          - /orchestration/cache.fsx
+        env:
+          - name: CACHE_ACTION
+            value: export
+        resources:
+          requests:
+            cpu: '1'
+            memory: 512Mi
+          limits:
+            cpu: '3'
+            memory: 2Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: orchestration
+            mountPath: /orchestration
+            readOnly: true
+          - name: cache-auth
+            mountPath: /cache-auth
+            readOnly: true
+          - name: cache-ca
+            mountPath: /cache-ca
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /toolchain
+            subPath: toolchain
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /state
+            subPath: state
+            readOnly: true
+          - name: workflow-workspace
+            mountPath: /tmp
+            subPath: output/cache-tmp
+      volumes:
+        - name: orchestration
+          configMap:
+            name: hf-orchestration
+            defaultMode: 292
+        - name: cache-auth
+          secret:
+            secretName: project-delivery-cache-writer
+            defaultMode: 288
+        - name: cache-ca
+          secret:
+            secretName: quay-internal-ca
+            defaultMode: 288
+        - name: workflow-workspace
+          persistentVolumeClaim:
+            claimName: '{{inputs.parameters.working-pvc}}'
--- a/services/project-delivery/k8s/workflows/hf-chat-ui/kustomization.yaml
+++ b/services/project-delivery/k8s/workflows/hf-chat-ui/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - delivery
+  - network-policy.yaml
--- a/services/project-delivery/k8s/workflows/hf-chat-ui/network-policy.yaml
+++ b/services/project-delivery/k8s/workflows/hf-chat-ui/network-policy.yaml
@ -0,0 +1,250 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-tools
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: hf-tools
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+          rules:
+            dns:
+              - matchName: packages.wolfi.dev
+    - toFQDNs:
+        - matchName: packages.wolfi.dev
+      toPorts:
+        - ports:
+            - port: '443'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-source
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: hf-source
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+          rules:
+            dns:
+              - matchName: forge-git-http.forgejo-public.svc.cluster.local
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: forgejo-public
+            app.kubernetes.io/name: forgejo
+            app.kubernetes.io/instance: forge-git
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-toolchain
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: hf-toolchain
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+          rules:
+            dns:
+              - matchName: packages.wolfi.dev
+              - matchName: nodejs.org
+              - matchName: registry.npmjs.org
+    - toFQDNs:
+        - matchName: packages.wolfi.dev
+        - matchName: nodejs.org
+        - matchName: registry.npmjs.org
+      toPorts:
+        - ports:
+            - port: '443'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-cache
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: delivery.quorate.dev/stage
+        operator: In
+        values:
+          - hf-cache-pull
+          - hf-cache-export
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+          rules:
+            dns:
+              - matchName: s3.quorate.internal
+    - toCIDR:
+        - 10.66.127.81/32
+      toPorts:
+        - ports:
+            - port: '443'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: versitygw
+            app.kubernetes.io/name: versitygw
+            app.kubernetes.io/instance: versitygw
+      toPorts:
+        - ports:
+            - port: '7070'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-publication
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: hf-publication
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: '53'
+              protocol: UDP
+            - port: '53'
+              protocol: TCP
+    - toCIDR:
+        - 10.108.252.250/32
+        - 10.66.127.81/32
+      toPorts:
+        - ports:
+            - port: '443'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: quay
+            app: quay
+      toPorts:
+        - ports:
+            - port: '8443'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-delivery
+  namespace: forgejo-public
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: forgejo
+      app.kubernetes.io/instance: forge-git
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+          matchExpressions:
+            - key: delivery.quorate.dev/stage
+              operator: In
+              values:
+                - hf-source
+      toPorts:
+        - ports:
+            - port: '3000'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-delivery
+  namespace: quay
+spec:
+  endpointSelector:
+    matchLabels:
+      app: quay
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+          matchExpressions:
+            - key: delivery.quorate.dev/stage
+              operator: In
+              values:
+                - hf-publication
+      toPorts:
+        - ports:
+            - port: '8443'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hf-delivery
+  namespace: versitygw
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: versitygw
+      app.kubernetes.io/instance: versitygw
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+          matchExpressions:
+            - key: delivery.quorate.dev/stage
+              operator: In
+              values:
+                - hf-cache-pull
+                - hf-cache-export
+      toPorts:
+        - ports:
+            - port: '7070'
+              protocol: TCP