ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/workflows/locutory/kustomization.yaml

@@ -0,0 +1,54 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namePrefix: locutory-
+resources:
+  - ../go-oci/base
+  - network-policy.yaml
+patches:
+  - target:
+      kind: WorkflowTemplate
+      name: build
+    patch: |-
+      - op: replace
+        path: /metadata/labels/app.kubernetes.io~1instance
+        value: locutory
+      - op: replace
+        path: /spec/podMetadata/labels/delivery.quorate.dev~1project
+        value: locutory
+      - op: replace
+        path: /spec/templates/2/dag/tasks/4/name
+        value: pages-publish
+      - op: replace
+        path: /spec/templates/2/dag/tasks/4/template
+        value: pages-publish
+      - op: replace
+        path: /spec/templates/2/outputs/parameters/0/valueFrom/parameter
+        value: "{{tasks.pages-publish.outputs.parameters.delivery-result}}"
+      - op: replace
+        path: /spec/templates/3/metadata/labels/delivery.quorate.dev~1stage
+        value: locutory-source
+      - op: replace
+        path: /spec/templates/3/volumes/1/secret/secretName
+        value: locutory-pull
+      - op: replace
+        path: /spec/templates/5/metadata/labels/delivery.quorate.dev~1stage
+        value: locutory-toolchain
+      - op: replace
+        path: /spec/templates/6/metadata/labels/delivery.quorate.dev~1stage
+        value: locutory-render
+      - op: replace
+        path: /spec/templates/7/name
+        value: pages-publish
+      - op: replace
+        path: /spec/templates/7/metadata/labels/delivery.quorate.dev~1stage
+        value: locutory-publish
+      - op: replace
+        path: /spec/templates/7/container/volumeMounts/1
+        value: {name: pages-auth, mountPath: /auth, readOnly: true}
+      - op: remove
+        path: /spec/templates/7/container/volumeMounts/2
+      - op: replace
+        path: /spec/templates/7/volumes/1
+        value: {name: pages-auth, secret: {secretName: locutory-pages, defaultMode: 0440}}
+      - op: remove
+        path: /spec/templates/7/volumes/2

services/project-delivery/k8s/workflows/locutory/network-policy.yaml

@@ -0,0 +1,109 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: source
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: locutory-source
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: forge-git-http.forgejo-public.svc.cluster.local
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: forgejo-public
+            app.kubernetes.io/name: forgejo
+            app.kubernetes.io/instance: forge-git
+      toPorts:
+        - ports:
+            - {port: "3000", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: source-ingress
+  namespace: forgejo-public
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: forgejo
+      app.kubernetes.io/instance: forge-git
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: project-delivery
+            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
+            delivery.quorate.dev/stage: locutory-source
+      toPorts:
+        - ports:
+            - {port: "3000", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: toolchain
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: locutory-toolchain
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: nodejs.org
+              - matchName: github.com
+              - matchName: release-assets.githubusercontent.com
+              - matchName: registry.npmjs.org
+    - toFQDNs:
+        - matchName: nodejs.org
+        - matchName: github.com
+        - matchName: release-assets.githubusercontent.com
+        - matchName: registry.npmjs.org
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: publish
+  namespace: project-delivery
+spec:
+  endpointSelector:
+    matchLabels:
+      delivery.quorate.dev/stage: locutory-publish
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - {port: "53", protocol: UDP}
+            - {port: "53", protocol: TCP}
+          rules:
+            dns:
+              - matchName: api.cloudflare.com
+    - toFQDNs:
+        - matchName: api.cloudflare.com
+      toPorts:
+        - ports:
+            - {port: "443", protocol: TCP}