platform/manifests
1
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

wip: try nixidy

Browse Source
This commit is contained in:
Jonas Juselius
2024-10-10 16:04:41 +02:00
parent 61379ad665
commit 11b398801d
66 changed files with 55100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/oceanbox/kyverno/add-ingress-whitelist.yaml
+20
View File
@@ -0,0 +1,20 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-ingress-whitelist
spec:
background: true
generateExisting: true
rules:
- name: set-whitelist-internal
mutate:
patchStrategicMerge:
metadata:
annotations:
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
match:
resources:
kinds:
- Ingress
annotations:
atlantis.oceanbox.io/expose: internal
policies/oceanbox/kyverno/remove-argocd-tracking-id.yaml
+31
View File
@@ -0,0 +1,31 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: remove-argocd-tracking-id
spec:
background: true
generateExisting: true
rules:
- name: remove-argocd-tracking-ids
mutate:
patchesJson6902: |-
- path: /metadata/annotations/argocd.argoproj.io~1tracking-id
op: remove
match:
any:
- resources:
kinds:
- Secret
names:
- prod-rabbitmq
- staging-rabbitmq
- prod-redis
- staging-redis
exclude:
any:
- resources:
kinds:
- Namespace
names:
- rabbitmq
- redis
policies/oceanbox/kyverno/sync-atlantis-secrets.yaml
+111
View File
@@ -0,0 +1,111 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: sync-dev-atlantis-secrets
spec:
background: true
generateExisting: false
rules:
- name: sync-rabbitmq-secret
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: staging-rabbitmq
namespace: rabbitmq
match:
any:
- resources:
kinds:
- Secret
names:
- "*-rabbitmq"
annotations:
kyverno/clone: "true"
- name: sync-redis-secret
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: staging-redis
namespace: redis
match:
any:
- resources:
kinds:
- Secret
names:
- "*-redis"
annotations:
kyverno/clone: "true"
- name: sync-archmaester-secret
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: prod-archmeister-superuser
namespace: atlantis
match:
any:
- resources:
kinds:
- Secret
names:
- "*-db-superuser"
annotations:
kyverno/clone: "true"
- name: sync-archmaester-replication-secret
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: prod-archmeister-replication
namespace: atlantis
match:
any:
- resources:
kinds:
- Secret
names:
- prod-archmeister-replication
annotations:
kyverno/clone: "true"
- name: sync-archmaester-ca
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: prod-archmeister-ca
namespace: atlantis
match:
any:
- resources:
kinds:
- Secret
names:
- prod-archmeister-ca
annotations:
kyverno/clone: "true"
# exclude:
# any:
# - resources:
# kinds:
# - Secret
# selector:
# matchLabels:
# generate.kyverno.io/clone-source: ""
policies/oceanbox/kyverno/sync-regcred.yaml
+44
View File
@@ -0,0 +1,44 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
annotations:
policies.kyverno.io/category: Sample
policies.kyverno.io/description: 'Secrets like registry credentials often need
to exist in multiple Namespaces so Pods there have access. Manually duplicating
those Secrets is time consuming and error prone. This policy will copy a Secret
called `regcred` which exists in the `default` Namespace to new Namespaces when
they are created. It will also push updates to the copied Secrets should the
source Secret be changed. '
creationTimestamp: "2024-01-15T11:58:24Z"
name: sync-oceanbox-regcred
spec:
admission: true
background: true
generateExisting: true
rules:
- generate:
apiVersion: v1
clone:
# name: oceanbox-regcred
name: gitlab-pull-secret
namespace: default
kind: Secret
# name: oceanbox-regcred
name: gitlab-pull-secret
namespace: '{{request.object.metadata.name}}'
synchronize: true
exclude:
any:
- resources:
kinds:
- Namespace
names:
- "vcluster-*"
match:
any:
- resources:
kinds:
- Namespace
name: sync-oceanbox-regcred
policies/oceanbox/network/allow-ceph-egress.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-ceph-egress
spec:
egress:
- toCIDR:
- 10.255.241.30/32
- 10.255.241.31/32
- 10.255.241.32/32
- 10.255.244.0/24
# toPorts:
# - ports:
# - port: "4443"
# protocol: TCP
endpointSelector: {}
policies/oceanbox/network/allow-microsoft-oidc-login.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-microsoft-oidc-login
spec:
endpointSelector: {}
egress:
- toFQDNs:
- matchName: login.microsoftonline.com
- matchPattern: '*.microsoftonline.com'
policies/oceanbox/network/atlantis/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: atlantis
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/atlantis/atlantis-policies.yaml
+26
View File
@@ -0,0 +1,26 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-atlantis-services
namespace: {{ .Release.Namespace }}
spec:
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: dapr-system
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: {{ .Values.rabbitmq.namespace | default "rabbitmq" }}
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: {{ .Values.tracing.namespace | default "otel" }}
- toFQDNs:
- matchName: '*.oceanbox.io'
- matchName: api.github.com
- matchName: dapr.github.io
- matchName: gitlab.com
- matchPattern: '*.gitlab.com'
- matchPattern: "*.k1.itpartner.no"
- matchName: analytics.loft.rocks
endpointSelector:
matchLabels: {}
policies/oceanbox/network/clusterpolicy-allow-api-server.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-kube-apiserver
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
policies/oceanbox/network/clusterpolicy-allow-ekman-egress.yaml
+18
View File
@@ -0,0 +1,18 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-ekman-egress
spec:
endpointSelector: {}
egress:
- toCIDR:
- 10.255.241.99/32
- 10.255.241.100/32
toPorts:
- ports:
- port: "4443"
protocol: TCP
- port: "30443"
protocol: TCP
- port: "30080"
protocol: TCP
policies/oceanbox/network/clusterpolicy-allow-namespace-traffic.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-namespace-traffic
spec:
description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
endpointSelector: {}
ingress:
- fromEndpoints:
- matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
egress:
- toEndpoints:
- matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
rules:
dns:
- matchPattern: "*"
policies/oceanbox/network/clusterpolicy-allow-oceanboxio.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-oceanboxio-egress
spec:
endpointSelector: {}
egress:
- toFQDNs:
- matchName: oceanbox.io
- matchName: hubble.srv.oceanbox.io
- matchPattern: "*oceanbox.io"
- matchPattern: "*.oceanbox.io"
policies/oceanbox/network/clusterpolicy-allow-remote-node.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-remote-node-webhooks
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
policies/oceanbox/network/csi-addons-controller/allow-9070-host.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: allow-host-port-9070
namespace: csi-addons-system
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: csi-addons
egress:
- toEntities:
- host
toPorts:
- ports:
- port: "9070"
protocol: TCP
policies/oceanbox/network/dapr/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: dapr-system
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/dapr/allow-remote-node.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-remote-node-webhooks
namespace: dapr-system
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
- remote-node
- toPorts:
- ports:
- port: "4000"
protocol: TCP
policies/oceanbox/network/default.nix
+7
View File
@@ -0,0 +1,7 @@
{ ... }:
{
imports = [
./external-ceph.nix
./microsoftonline.nix
];
}
policies/oceanbox/network/external-ceph.nix
+22
View File
@@ -0,0 +1,22 @@
{ ... }:
{
applications.netpol-external-ceph = {
resources = {
ciliumClusterwideNetworkPolicies = {
allow-external-ceph-egress.spec = {
egress = [
{
toCIDR = [
"10.255.241.30/32"
"10.255.241.31/32"
"10.255.241.32/32"
"10.255.244.0/24"
];
}
];
endpointSelector = { };
};
};
};
};
}
policies/oceanbox/network/geoserver/allow-geoserver-ingress.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-geoserver-ingress
namespace: geoserver
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/instance: geoserver
ingress:
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
policies/oceanbox/network/idp/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: idp
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/idp/allow-gitlab.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-grafana-oidc-login
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: cerbos
egress:
- toFQDNs:
- matchName: gitlab.com
- matchPattern: '*.gitlab.com'
policies/oceanbox/network/idp/allow-idp-external-access.yaml
+13
View File
@@ -0,0 +1,13 @@
piVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-external-idp
spec:
egress:
- toFQDNs:
- matchName: login.microsoftonline.com
- matchName: graph.microsoft.com
- matchName: s3.k1.itpartner.no
- matchName: telemetry.cerbos.dev
endpointSelector: {}
policies/oceanbox/network/idp/allow-itp-smtpgw.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-itp-smtp
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: keycloak
egress:
- toFQDNs:
- matchName: smtpgw.itpartner.no
policies/oceanbox/network/idp/allow-keycloak.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-keycloak
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: dex
egress:
- toFQDNs:
- matchName: auth.srv.oceanbox.io
policies/oceanbox/network/jaeger/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: jaeger
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/jaeger/allow-remote-node.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-remote-node-webhooks
namespace: jaeger
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
- toPorts:
- ports:
- port: "9443"
protocol: TCP
- port: "443"
protocol: TCP
policies/oceanbox/network/microsoftonline.nix
+21
View File
@@ -0,0 +1,21 @@
{ ... }:
{
applications.netpol-microsoftonline = {
project = "netpol";
resources = {
ciliumClusterwideNetworkPolicies = {
allow-microsoftonline.spec = {
endpointSelector = { };
egress = [
{
toFQDNs = [
{ matchName = "login.microsoftonline.com"; }
{ matchPattern = "*.microsoftonline.com"; }
];
}
];
};
};
};
};
}
policies/oceanbox/network/rabbitmq/policy-allow-rabbitmq.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-world-to-rabbitmq-http
namespace: rabbitmq
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: rabbitmq
ingress:
- fromEntities:
- world
- toPorts:
- ports:
- port: "15672"
protocol: TCP
policies/oceanbox/network/templ.nix
+11
View File
@@ -0,0 +1,11 @@
{ ... }:
{
applications.xxx = {
resources = {
ciliumClusterwideNetworkPolicies = {
xxx.spec = {
};
};
};
};
}