ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

228
services/project-delivery/k8s/workflows/layshaft/network-policy.yaml Normal file
View file

@ -0,0 +1,228 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-forgejo
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values: [layshaft-source, layshaft-client-pub]
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: forge-git-http.forgejo-public.svc.cluster.local
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: forgejo-public
app.kubernetes.io/name: forgejo
app.kubernetes.io/instance: forge-git
toPorts:
- ports: [{port: '3000', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-cache
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
matchExpressions:
- key: delivery.quorate.dev/stage
operator: In
values: [layshaft-pull, layshaft-export]
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: s3.quorate.internal
- toCIDR: [10.66.127.81/32]
toPorts:
- ports: [{port: '443', protocol: TCP}]
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports: [{port: '7070', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-sdk
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-tools
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: builds.dotnet.microsoft.com
- toFQDNs:
- matchName: builds.dotnet.microsoft.com
toPorts:
- ports: [{port: '443', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-rpm-tools
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-tools
delivery.quorate.dev/lane: client
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: github.com
- matchName: release-assets.githubusercontent.com
- toFQDNs:
- matchName: github.com
- matchName: release-assets.githubusercontent.com
toPorts:
- ports: [{port: '443', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-runtime
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-tools
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: packages.wolfi.dev
- toFQDNs:
- matchName: packages.wolfi.dev
toPorts:
- ports: [{port: '443', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-linker
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-tools
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: archive.ubuntu.com
- matchName: ports.ubuntu.com
- toFQDNs:
- matchName: archive.ubuntu.com
- matchName: ports.ubuntu.com
toPorts:
- ports: [{port: '443', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-build
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-build
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: api.nuget.org
- matchName: www.nuget.org
- matchName: globalcdn.nuget.org
- toFQDNs:
- matchName: api.nuget.org
- matchName: www.nuget.org
- matchName: globalcdn.nuget.org
toPorts:
- ports: [{port: '443', protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: layshaft-quay
namespace: project-delivery
spec:
endpointSelector:
matchLabels:
delivery.quorate.dev/project: layshaft
delivery.quorate.dev/stage: layshaft-server-pub
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports: [{port: '53', protocol: UDP}, {port: '53', protocol: TCP}]
rules:
dns:
- matchName: registry.quorate.internal
- toCIDR: [10.108.252.250/32]
toPorts:
- ports: [{port: '443', protocol: TCP}]
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: quay
app: quay
toPorts:
- ports: [{port: '8443', protocol: TCP}]