apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: rcon-tools
  namespace: project-delivery
spec:
  endpointSelector:
    matchExpressions:
    - key: delivery.quorate.dev/stage
      operator: In
      values:
      - rcon-tools
  egress:
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: '53'
        protocol: UDP
      - port: '53'
        protocol: TCP
      rules:
        dns:
        - matchName: go.dev
        - matchName: dl.google.com
        - matchName: nodejs.org
        - matchName: proxy.golang.org
        - matchName: sum.golang.org
        - matchName: storage.googleapis.com
        - matchName: registry.npmjs.org
        - matchName: codeload.github.com
  - toFQDNs:
    - matchName: go.dev
    - matchName: dl.google.com
    - matchName: nodejs.org
    - matchName: proxy.golang.org
    - matchName: sum.golang.org
    - matchName: storage.googleapis.com
    - matchName: registry.npmjs.org
    - matchName: codeload.github.com
    toPorts:
    - ports:
      - port: '443'
        protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: rcon-s3
  namespace: project-delivery
spec:
  endpointSelector:
    matchExpressions:
    - key: delivery.quorate.dev/stage
      operator: In
      values:
      - rcon-publish
      - rcon-cache-pull
      - rcon-cache-export
  egress:
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s-app: kube-dns
    toPorts:
    - ports:
      - port: '53'
        protocol: UDP
      - port: '53'
        protocol: TCP
      rules:
        dns:
        - matchName: s3.quorate.internal
  - toFQDNs:
    - matchName: s3.quorate.internal
    toPorts:
    - ports:
      - port: '443'
        protocol: TCP
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: versitygw
        app.kubernetes.io/name: versitygw
        app.kubernetes.io/instance: versitygw
    toPorts:
    - ports:
      - port: '7070'
        protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: rcon-delivery
  namespace: versitygw
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: versitygw
      app.kubernetes.io/instance: versitygw
  ingress:
  - fromEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: project-delivery
        io.cilium.k8s.policy.serviceaccount: project-delivery-executor
      matchExpressions:
      - key: delivery.quorate.dev/stage
        operator: In
        values:
        - rcon-publish
        - rcon-cache-pull
        - rcon-cache-export
    toPorts:
    - ports:
      - port: '7070'
        protocol: TCP