apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: tools
  namespace: project-delivery
spec:
  endpointSelector:
    matchLabels:
      delivery.quorate.dev/stage: quay-toolchain
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - {port: "53", protocol: UDP}
            - {port: "53", protocol: TCP}
          rules:
            dns:
              - {matchName: packages.wolfi.dev}
              - {matchName: dl.google.com}
              - {matchName: github.com}
              - {matchPattern: "*.github.com"}
              - {matchName: proxy.golang.org}
              - {matchName: storage.googleapis.com}
              - {matchName: sum.golang.org}
              - {matchName: files.pythonhosted.org}
              - {matchName: cdn-ubi.redhat.com}
              - {matchName: quay.io}
              - {matchPattern: "*.quay.io"}
    - toFQDNs:
        - {matchName: packages.wolfi.dev}
        - {matchName: dl.google.com}
        - {matchName: github.com}
        - {matchPattern: "*.github.com"}
        - {matchName: proxy.golang.org}
        - {matchName: storage.googleapis.com}
        - {matchName: sum.golang.org}
        - {matchName: files.pythonhosted.org}
        - {matchName: cdn-ubi.redhat.com}
        - {matchName: quay.io}
        - {matchPattern: "*.quay.io"}
      toPorts:
        - ports:
            - {port: "443", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: publish
  namespace: project-delivery
spec:
  endpointSelector:
    matchLabels:
      delivery.quorate.dev/stage: quay-publish
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - {port: "53", protocol: UDP}
            - {port: "53", protocol: TCP}
          rules:
            dns:
              - {matchName: zot.quorate.internal}
    - toCIDR: [172.28.129.182/32]
      toPorts:
        - ports:
            - {port: "443", protocol: TCP}
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: zot
            app.kubernetes.io/name: zot
            app.kubernetes.io/instance: zot
      toPorts:
        - ports:
            - {port: "5000", protocol: TCP}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: zot-in
  namespace: zot
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: zot
      app.kubernetes.io/instance: zot
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: project-delivery
            io.cilium.k8s.policy.serviceaccount: project-delivery-executor
            delivery.quorate.dev/stage: quay-publish
      toPorts:
        - ports:
            - {port: "5000", protocol: TCP}