259 lines
6.7 KiB
YAML
259 lines
6.7 KiB
YAML
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-controller
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
io.cilium.k8s.policy.serviceaccount: mirrored-image
|
|
egress:
|
|
- toEntities: [kube-apiserver]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- {port: "53", protocol: UDP}
|
|
- {port: "53", protocol: TCP}
|
|
rules:
|
|
dns:
|
|
- {matchName: registry.quorate.internal}
|
|
- toCIDR: [10.108.252.250/32]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: quay
|
|
app: quay
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-executor
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchExpressions:
|
|
- key: workflows.argoproj.io/workflow
|
|
operator: Exists
|
|
egress:
|
|
- toEntities: [kube-apiserver]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-prepare
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
mirror.quorate.dev/purpose: prepare
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- {port: "53", protocol: UDP}
|
|
- {port: "53", protocol: TCP}
|
|
rules:
|
|
dns:
|
|
- {matchPattern: "*"}
|
|
- toEntities: [world]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toCIDR: [10.108.252.250/32]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: quay
|
|
app: quay
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-internal
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchExpressions:
|
|
- key: mirror.quorate.dev/purpose
|
|
operator: In
|
|
values: [promotion, cleanup]
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- {port: "53", protocol: UDP}
|
|
- {port: "53", protocol: TCP}
|
|
rules:
|
|
dns:
|
|
- {matchName: registry.quorate.internal}
|
|
- toCIDR: [10.108.252.250/32]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: quay
|
|
app: quay
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-prep-storage
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
io.cilium.k8s.policy.serviceaccount: candidate-exec
|
|
mirror.quorate.dev/purpose: prepare
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: versitygw
|
|
app.kubernetes.io/name: versitygw
|
|
app.kubernetes.io/instance: versitygw
|
|
toPorts:
|
|
- ports:
|
|
- {port: "7070", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-prep-storage
|
|
namespace: versitygw
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: versitygw
|
|
app.kubernetes.io/instance: versitygw
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
io.cilium.k8s.policy.serviceaccount: candidate-exec
|
|
mirror.quorate.dev/purpose: prepare
|
|
toPorts:
|
|
- ports:
|
|
- {port: "7070", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-promotion-storage
|
|
namespace: mirrored-image
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
mirror.quorate.dev/purpose: promotion
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- {port: "53", protocol: UDP}
|
|
- {port: "53", protocol: TCP}
|
|
rules:
|
|
dns:
|
|
- {matchName: s3.quorate.internal}
|
|
- toCIDR: [10.66.127.81/32]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "443", protocol: TCP}
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: versitygw
|
|
app.kubernetes.io/name: versitygw
|
|
app.kubernetes.io/instance: versitygw
|
|
toPorts:
|
|
- ports:
|
|
- {port: "7070", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-promotion-storage
|
|
namespace: versitygw
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: versitygw
|
|
app.kubernetes.io/instance: versitygw
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: mirrored-image
|
|
io.cilium.k8s.policy.serviceaccount: promote-exec
|
|
mirror.quorate.dev/purpose: promotion
|
|
toPorts:
|
|
- ports:
|
|
- {port: "7070", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: mirror-quay
|
|
namespace: quay
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app: quay
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchExpressions:
|
|
- key: k8s:io.kubernetes.pod.namespace
|
|
operator: In
|
|
values: [mirrored-image]
|
|
- key: io.cilium.k8s.policy.serviceaccount
|
|
operator: In
|
|
values: [mirrored-image, candidate-exec, promote-exec, cleanup-exec]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "8443", protocol: TCP}
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: mirror-quay-replies
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchExpressions:
|
|
- key: k8s:io.kubernetes.pod.namespace
|
|
operator: In
|
|
values: [mirrored-image]
|
|
- key: io.cilium.k8s.policy.serviceaccount
|
|
operator: In
|
|
values: [mirrored-image, candidate-exec, promote-exec, cleanup-exec]
|
|
toPorts:
|
|
- ports:
|
|
- {port: "32768", endPort: 60999, protocol: TCP}
|