ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/bootstrap/accounts.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-vso
+  namespace: short
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-seed
+  namespace: short
+imagePullSecrets:
+- name: pull

services/short/k8s/bootstrap/job.yaml

@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: seed
+  namespace: short
+  annotations:
+    kustomize.toolkit.fluxcd.io/force: Enabled
+spec:
+  completions: 2
+  parallelism: 2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: seed
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-seed
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: seed
+        image: short-image
+        args:
+        - seed
+        env:
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 32Mi
+          limits:
+            memory: 128Mi
+        volumeMounts:
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca

services/short/k8s/bootstrap/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - accounts.yaml
+  - vault.yaml
+  - job.yaml
+  - policy.yaml
+  - vault-access.yaml

services/short/k8s/bootstrap/namespace.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: short
+  labels: {gateway.quorate.internal/allow-short: "true"}

services/short/k8s/bootstrap/policy.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: seed
+  namespace: short
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: seed
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchPattern: '*'
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: vault
+        app.kubernetes.io/name: vault
+    toPorts:
+    - ports:
+      - port: '8200'
+        protocol: TCP

services/short/k8s/bootstrap/vault-access.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: short, namespace: vault}
+spec:
+  endpointSelector:
+    matchLabels: {app.kubernetes.io/name: vault, component: server}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/instance: short
+          matchExpressions:
+            - key: app.kubernetes.io/name
+              operator: In
+              values: [seed, controller]
+      toPorts:
+        - ports: [{port: "8200", protocol: TCP}]

services/short/k8s/bootstrap/vault.yaml

@@ -0,0 +1,60 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: short
+  namespace: short
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: short-vso
+    serviceAccount: short-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: pull
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: pull
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        .dockerconfigjson:
+          text: '{"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s"
+            (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: ca
+  namespace: short
+spec:
+  vaultAuthRef: short
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'

services/short/k8s/control/deployment.yaml

@@ -0,0 +1,114 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: short
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: controller
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-controller
+      imagePullSecrets:
+      - name: pull
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: controller
+                app.kubernetes.io/instance: short
+      containers:
+      - name: controller
+        image: short-image
+        args:
+        - controller
+        env:
+        - name: POD_UID
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.uid
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: OPNSENSE_URL
+          value: https://10.212.111.120:8443
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 192Mi
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca
+      - name: config
+        projected:
+          defaultMode: 288
+          sources:
+          - secret:
+              name: api
+              items:
+              - key: private_key
+                path: private_key
+          - secret:
+              name: cloud
+              items:
+              - key: config
+                path: cloud.json
+          - secret:
+              name: opnsense
+              items:
+              - key: key
+                path: opnsense/key
+              - key: secret
+                path: opnsense/secret
+          - secret:
+              name: ca-opnsense
+              items:
+              - key: ca.crt
+                path: opnsense/ca.crt
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: controller
+  namespace: short
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller

services/short/k8s/control/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - rbac.yaml
+  - vault.yaml
+  - policy.yaml

services/short/k8s/control/policy.yaml

@@ -0,0 +1,43 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: controller
+  namespace: short
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: controller
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s:k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: '53'
+        protocol: UDP
+      - port: '53'
+        protocol: TCP
+      rules:
+        dns:
+        - matchPattern: '*'
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: vault
+        app.kubernetes.io/name: vault
+    toPorts:
+    - ports:
+      - port: '8200'
+        protocol: TCP
+  - toCIDR:
+    - 10.212.111.120/32
+    toPorts:
+    - ports:
+      - port: '8443'
+        protocol: TCP
+  - toFQDNs:
+    - matchPattern: iaas.*.oraclecloud.com
+    toPorts:
+    - ports:
+      - port: '443'
+        protocol: TCP

services/short/k8s/control/rbac.yaml

@@ -0,0 +1,107 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: short-controller
+  namespace: short
+---
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  name: controller
+  namespace: short
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: controller
+  namespace: short
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - controller
+  verbs:
+  - get
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: controller
+  namespace: short
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: controller
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: short
+  annotations:
+    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+spec:
+  externalCIDRs: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: short-peers
+rules:
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumcidrgroups
+  resourceNames:
+  - short
+  verbs:
+  - get
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: short-peers
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: short-peers
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: short-gateway
+  namespace: kube-system
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - services
+  resourceNames:
+  - cilium-gateway-gateway-short
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: short-gateway
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: short-gateway
+subjects:
+- kind: ServiceAccount
+  name: short-controller
+  namespace: short

services/short/k8s/control/vault.yaml

@@ -0,0 +1,111 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: api
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/api
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: api
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        private_key:
+          text: '{{ get .Secrets "private_key" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cloud
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/cloud
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: cloud
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        config:
+          text: '{{ get .Secrets "config" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: opnsense/interface-watcher
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        key:
+          text: '{{ get .Secrets "key" }}'
+        secret:
+          text: '{{ get .Secrets "secret" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense-ca
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: ca/opnsense
+  hmacSecretData: true
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca-opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller

services/short/k8s/gateway/gateway.yaml

@@ -0,0 +1,38 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata: {name: gateway-short, namespace: kube-system}
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: minecraft
+      port: 25565
+      protocol: TCP
+      allowedRoutes:
+        kinds: [{kind: TCPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: nlb-canary.quorate.dev
+      tls:
+        mode: Terminate
+        certificateRefs: [{kind: Secret, name: gateway-relay-tls}]
+      allowedRoutes:
+        kinds: [{kind: HTTPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: nlb-canary.quorate.dev
+      allowedRoutes:
+        kinds: [{kind: HTTPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}

services/short/k8s/gateway/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gateway.yaml
+  - ../../../../vendor/workloads/short-canary
+  - policy.yaml

services/short/k8s/gateway/policy.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: gateway-short}
+spec:
+  endpointSelector:
+    matchLabels: {"reserved:ingress": ""}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: tunnel
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "80", protocol: TCP}, {port: "443", protocol: TCP}]

services/short/k8s/tunnel/admission.yaml

@@ -0,0 +1,49 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata: {name: short-election}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: [""]
+        apiVersions: [v1]
+        operations: [UPDATE]
+        resources: [pods]
+  matchConditions:
+    - name: tunnel-account
+      expression: request.userInfo.username == 'system:serviceaccount:short:tunnel'
+  variables:
+    - name: labels
+      expression: "has(object.metadata.labels) ? object.metadata.labels : {}"
+    - name: oldLabels
+      expression: "has(oldObject.metadata.labels) ? oldObject.metadata.labels : {}"
+  validations:
+    - expression: >-
+        oldObject.metadata.namespace == 'short' &&
+        oldObject.spec.serviceAccountName == 'tunnel' &&
+        'app.kubernetes.io/name' in variables.oldLabels &&
+        variables.oldLabels['app.kubernetes.io/name'] == 'tunnel'
+      message: The tunnel may only update tunnel pods.
+    - expression: object.spec == oldObject.spec
+      message: The tunnel may not change pod specifications.
+    - expression: >-
+        variables.labels.all(k, k == 'role' ||
+          (k in variables.oldLabels && variables.labels[k] == variables.oldLabels[k])) &&
+        variables.oldLabels.all(k, k == 'role' || k in variables.labels) &&
+        (!('role' in variables.labels) || variables.labels['role'] == 'active')
+      message: The tunnel may only set or remove the active role label.
+    - expression: >-
+        (has(object.metadata.annotations) ? object.metadata.annotations : {}) ==
+        (has(oldObject.metadata.annotations) ? oldObject.metadata.annotations : {}) &&
+        (has(object.metadata.ownerReferences) ? object.metadata.ownerReferences : []) ==
+        (has(oldObject.metadata.ownerReferences) ? oldObject.metadata.ownerReferences : []) &&
+        (has(object.metadata.finalizers) ? object.metadata.finalizers : []) ==
+        (has(oldObject.metadata.finalizers) ? oldObject.metadata.finalizers : [])
+      message: The tunnel may not change annotations, owners, or finalizers.
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata: {name: short-election}
+spec:
+  policyName: short-election
+  validationActions: [Deny]

services/short/k8s/tunnel/deployment.yaml

@@ -0,0 +1,156 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tunnel
+  namespace: short
+spec:
+  replicas: 2
+  template:
+    spec:
+      imagePullSecrets:
+      - name: pull
+      initContainers:
+      - name: stage
+        image: short-image
+        args:
+        - stage
+        - /agent/short
+        securityContext:
+          runAsUser: 65532
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 25m
+            memory: 32Mi
+          limits:
+            memory: 64Mi
+        volumeMounts:
+        - name: agent
+          mountPath: /agent
+      containers:
+      - name: tunnel
+        image: docker.io/openeuler/strongswan@sha256:7cf59f44ca5e0b12938ce1cf66de437c6f7686d3d112c7057f30d8e055a608bc
+        command:
+        - /agent/short
+        args:
+        - tunnel
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_ADMIN
+            - NET_BIND_SERVICE
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            memory: 256Mi
+        ports:
+        - name: health
+          containerPort: 9090
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: health
+          periodSeconds: 5
+        volumeMounts:
+        - name: agent
+          mountPath: /agent
+          readOnly: true
+        - name: runtime
+          mountPath: /config
+          readOnly: true
+        - name: strongswan
+          mountPath: /usr/local/etc/strongswan.conf
+          subPath: strongswan.conf
+          readOnly: true
+        - name: run
+          mountPath: /var/run
+        - name: api
+          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          readOnly: true
+      volumes:
+      - name: api
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              expirationSeconds: 3600
+          - configMap:
+              name: kube-root-ca.crt
+              items:
+              - key: ca.crt
+                path: ca.crt
+      - name: agent
+        emptyDir: {}
+      - name: run
+        emptyDir: {}
+      - name: runtime
+        secret:
+          secretName: peers
+          items:
+          - key: config
+            path: runtime.json
+      - name: strongswan
+        configMap:
+          name: charon
+      securityContext:
+        fsGroup: 65532
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: tunnel
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: tunnel
+                app.kubernetes.io/instance: short
+    metadata:
+      labels:
+        app.kubernetes.io/name: tunnel
+        app.kubernetes.io/instance: short
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tunnel
+      app.kubernetes.io/instance: short
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: tunnel
+  namespace: short
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tunnel
+      app.kubernetes.io/instance: short

services/short/k8s/tunnel/endpoints.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata: {name: endpoints, namespace: short}
+data:
+  ike: "192.0.2.20"

services/short/k8s/tunnel/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - vault.yaml
+  - policy.yaml
+  - endpoints.yaml
+  - rbac.yaml
+  - admission.yaml
+replacements:
+  - source: {kind: ConfigMap, name: endpoints, fieldPath: data.ike}
+    targets:
+      - select: {kind: Service, name: ike}
+        fieldPaths: ["metadata.annotations.[lbipam.cilium.io/ips]"]
+configMapGenerator:
+  - name: charon
+    namespace: short
+    files: [strongswan.conf]

services/short/k8s/tunnel/policy.yaml

@@ -0,0 +1,59 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: tunnel, namespace: short}
+spec:
+  endpointSelector:
+    matchLabels: {app.kubernetes.io/name: tunnel, app.kubernetes.io/instance: short}
+  ingress:
+    - fromCIDRSet: [{cidrGroupRef: short}]
+      toPorts:
+        - ports: [{port: "500", protocol: UDP}, {port: "4500", protocol: UDP}]
+    - fromEntities: [host]
+      toPorts:
+        - ports: [{port: "9090", protocol: TCP}]
+  egress:
+    - toCIDRSet: [{cidrGroupRef: short}]
+      toPorts:
+        - ports: [{port: "500", protocol: UDP}, {port: "4500", protocol: UDP}]
+    - toEntities: [kube-apiserver]
+      toPorts:
+        - ports: [{port: "6443", protocol: TCP}]
+    - toEntities: [ingress]
+      toPorts:
+        - ports: [{port: "80", protocol: TCP}, {port: "443", protocol: TCP}]
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: short-canary
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "8080", protocol: TCP}]
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: minecraft
+            app.kubernetes.io/name: minecraft
+            app.kubernetes.io/instance: skies
+      toPorts:
+        - ports: [{port: "25565", protocol: TCP}]
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: short-tunnel-host}
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: tunnel
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "9090", protocol: TCP}]
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: tunnel
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "32768", endPort: 60999, protocol: TCP}]