apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: mirror-bootstrap
  namespace: mirrored-image
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: mirror-bootstrap
      app.kubernetes.io/instance: mirrored-image
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - {port: "53", protocol: UDP}
            - {port: "53", protocol: TCP}
    - toEntities: [kube-apiserver]
      toPorts:
        - ports:
            - {port: "443", protocol: TCP}
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: vault
            app.kubernetes.io/name: vault
            component: server
      toPorts:
        - ports:
            - {port: "8200", protocol: TCP}
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: zitadel
            app.kubernetes.io/name: zitadel
      toPorts:
        - ports:
            - {port: "8080", protocol: TCP}
    - toCIDR: [10.108.252.250/32]
      toPorts:
        - ports:
            - {port: "443", protocol: TCP}
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: quay
            app: quay
      toPorts:
        - ports:
            - {port: "8443", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: mirror-bootstrap
  namespace: vault
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: vault
      component: server
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: mirrored-image
            app.kubernetes.io/name: mirror-bootstrap
            app.kubernetes.io/instance: mirrored-image
      toPorts:
        - ports:
            - {port: "8200", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: mirror-bootstrap
  namespace: zitadel
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: zitadel
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: mirrored-image
            app.kubernetes.io/name: mirror-bootstrap
            app.kubernetes.io/instance: mirrored-image
      toPorts:
        - ports:
            - {port: "8080", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: mirror-bootstrap
  namespace: quay
spec:
  endpointSelector:
    matchLabels:
      app: quay
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: mirrored-image
            app.kubernetes.io/name: mirror-bootstrap
            app.kubernetes.io/instance: mirrored-image
      toPorts:
        - ports:
            - {port: "8443", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: mirror-boot-replies
spec:
  nodeSelector: {}
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: mirrored-image
            app.kubernetes.io/name: mirror-bootstrap
            app.kubernetes.io/instance: mirrored-image
      toPorts:
        - ports:
            - {port: "32768", endPort: 60999, protocol: TCP}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mirror-login-key
  namespace: zitadel
rules:
  - apiGroups: [""]
    resources: [secrets]
    resourceNames: [zitadel-login-service-key]
    verbs: [get]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mirror-login-key
  namespace: zitadel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mirror-login-key
subjects:
  - kind: ServiceAccount
    name: mirror-bootstrap
    namespace: mirrored-image