apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: go-release-forgejo
  namespace: project-delivery
spec:
  endpointSelector:
    matchExpressions:
    - key: delivery.quorate.dev/project
      operator: In
      values:
      - chultun
      - corago
      - zygostates
    - key: delivery.quorate.dev/stage
      operator: In
      values:
      - go-release-source
      - go-release-publish
  egress:
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: '53'
        protocol: UDP
      - port: '53'
        protocol: TCP
      rules:
        dns:
        - matchName: forge-git-http.forgejo-public.svc.cluster.local
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: forgejo-public
        app.kubernetes.io/name: forgejo
        app.kubernetes.io/instance: forge-git
    toPorts:
    - ports:
      - port: '3000'
        protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: go-release-cache
  namespace: project-delivery
spec:
  endpointSelector:
    matchExpressions:
    - key: delivery.quorate.dev/project
      operator: In
      values:
      - chultun
      - corago
      - zygostates
    - key: delivery.quorate.dev/stage
      operator: In
      values:
      - go-release-pull
      - go-release-export
  egress:
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: '53'
        protocol: UDP
      - port: '53'
        protocol: TCP
      rules:
        dns:
        - matchName: s3.quorate.internal
  - toCIDR:
    - 10.66.127.81/32
    toPorts:
    - ports:
      - port: '443'
        protocol: TCP
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: versitygw
        app.kubernetes.io/name: versitygw
        app.kubernetes.io/instance: versitygw
    toPorts:
    - ports:
      - port: '7070'
        protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: go-release-tools
  namespace: project-delivery
spec:
  endpointSelector:
    matchLabels:
      delivery.quorate.dev/stage: go-release-tools
    matchExpressions:
    - key: delivery.quorate.dev/project
      operator: In
      values:
      - chultun
      - corago
      - zygostates
  egress:
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: '53'
        protocol: UDP
      - port: '53'
        protocol: TCP
      rules:
        dns:
        - matchName: packages.wolfi.dev
        - matchName: proxy.golang.org
        - matchName: storage.googleapis.com
        - matchName: sum.golang.org
  - toFQDNs:
    - matchName: packages.wolfi.dev
    - matchName: proxy.golang.org
    - matchName: storage.googleapis.com
    - matchName: sum.golang.org
    toPorts:
    - ports:
      - port: '443'
        protocol: TCP