148 lines
3.7 KiB
YAML
148 lines
3.7 KiB
YAML
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-bootstrap
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mirror-bootstrap
|
|
app.kubernetes.io/instance: mirrored-image
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- {port: "53", protocol: UDP}
|
|
- {port: "53", protocol: TCP}
|
|
- toEntities: [kube-apiserver]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: vault
|
|
app.kubernetes.io/name: vault
|
|
component: server
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8200", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: zitadel
|
|
app.kubernetes.io/name: zitadel
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8080", protocol: TCP}
|
|
- toCIDR: [10.108.252.250/32]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: quay
|
|
app: quay
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-bootstrap
|
|
namespace: vault
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: vault
|
|
component: server
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
app.kubernetes.io/name: mirror-bootstrap
|
|
app.kubernetes.io/instance: mirrored-image
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8200", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-bootstrap
|
|
namespace: zitadel
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: zitadel
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
app.kubernetes.io/name: mirror-bootstrap
|
|
app.kubernetes.io/instance: mirrored-image
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8080", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-bootstrap
|
|
namespace: quay
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app: quay
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
app.kubernetes.io/name: mirror-bootstrap
|
|
app.kubernetes.io/instance: mirrored-image
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: mirror-boot-replies
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
app.kubernetes.io/name: mirror-bootstrap
|
|
app.kubernetes.io/instance: mirrored-image
|
|
toPorts:
|
|
- ports:
|
|
- {port: "32768", endPort: 60999, protocol: TCP}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: mirror-login-key
|
|
namespace: zitadel
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [secrets]
|
|
resourceNames: [zitadel-login-service-key]
|
|
verbs: [get]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: mirror-login-key
|
|
namespace: zitadel
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: mirror-login-key
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: mirror-bootstrap
|
|
namespace: mirrored-image
|