platform/manifests
1
0
Fork 0
Code Issues 7 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

wip: try nixidy

Browse Source
This commit is contained in:
Jonas Juselius
2024-10-10 16:04:41 +02:00
parent 61379ad665
commit 11b398801d
66 changed files with 55100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/oceanbox/network/allow-ceph-egress.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-ceph-egress
spec:
egress:
- toCIDR:
- 10.255.241.30/32
- 10.255.241.31/32
- 10.255.241.32/32
- 10.255.244.0/24
# toPorts:
# - ports:
# - port: "4443"
# protocol: TCP
endpointSelector: {}
policies/oceanbox/network/allow-microsoft-oidc-login.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-microsoft-oidc-login
spec:
endpointSelector: {}
egress:
- toFQDNs:
- matchName: login.microsoftonline.com
- matchPattern: '*.microsoftonline.com'
policies/oceanbox/network/atlantis/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: atlantis
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/atlantis/atlantis-policies.yaml
+26
View File
@@ -0,0 +1,26 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-atlantis-services
namespace: {{ .Release.Namespace }}
spec:
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: dapr-system
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: {{ .Values.rabbitmq.namespace | default "rabbitmq" }}
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: {{ .Values.tracing.namespace | default "otel" }}
- toFQDNs:
- matchName: '*.oceanbox.io'
- matchName: api.github.com
- matchName: dapr.github.io
- matchName: gitlab.com
- matchPattern: '*.gitlab.com'
- matchPattern: "*.k1.itpartner.no"
- matchName: analytics.loft.rocks
endpointSelector:
matchLabels: {}
policies/oceanbox/network/clusterpolicy-allow-api-server.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-kube-apiserver
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
policies/oceanbox/network/clusterpolicy-allow-ekman-egress.yaml
+18
View File
@@ -0,0 +1,18 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-ekman-egress
spec:
endpointSelector: {}
egress:
- toCIDR:
- 10.255.241.99/32
- 10.255.241.100/32
toPorts:
- ports:
- port: "4443"
protocol: TCP
- port: "30443"
protocol: TCP
- port: "30080"
protocol: TCP
policies/oceanbox/network/clusterpolicy-allow-namespace-traffic.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-namespace-traffic
spec:
description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
endpointSelector: {}
ingress:
- fromEndpoints:
- matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
egress:
- toEndpoints:
- matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
rules:
dns:
- matchPattern: "*"
policies/oceanbox/network/clusterpolicy-allow-oceanboxio.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-oceanboxio-egress
spec:
endpointSelector: {}
egress:
- toFQDNs:
- matchName: oceanbox.io
- matchName: hubble.srv.oceanbox.io
- matchPattern: "*oceanbox.io"
- matchPattern: "*.oceanbox.io"
policies/oceanbox/network/clusterpolicy-allow-remote-node.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: allow-remote-node-webhooks
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
policies/oceanbox/network/csi-addons-controller/allow-9070-host.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: allow-host-port-9070
namespace: csi-addons-system
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: csi-addons
egress:
- toEntities:
- host
toPorts:
- ports:
- port: "9070"
protocol: TCP
policies/oceanbox/network/dapr/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: dapr-system
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/dapr/allow-remote-node.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-remote-node-webhooks
namespace: dapr-system
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
- remote-node
- toPorts:
- ports:
- port: "4000"
protocol: TCP
policies/oceanbox/network/default.nix
+7
View File
@@ -0,0 +1,7 @@
{ ... }:
{
imports = [
./external-ceph.nix
./microsoftonline.nix
];
}
policies/oceanbox/network/external-ceph.nix
+22
View File
@@ -0,0 +1,22 @@
{ ... }:
{
applications.netpol-external-ceph = {
resources = {
ciliumClusterwideNetworkPolicies = {
allow-external-ceph-egress.spec = {
egress = [
{
toCIDR = [
"10.255.241.30/32"
"10.255.241.31/32"
"10.255.241.32/32"
"10.255.244.0/24"
];
}
];
endpointSelector = { };
};
};
};
};
}
policies/oceanbox/network/geoserver/allow-geoserver-ingress.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-geoserver-ingress
namespace: geoserver
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/instance: geoserver
ingress:
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
policies/oceanbox/network/idp/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: idp
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/idp/allow-gitlab.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-grafana-oidc-login
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: cerbos
egress:
- toFQDNs:
- matchName: gitlab.com
- matchPattern: '*.gitlab.com'
policies/oceanbox/network/idp/allow-idp-external-access.yaml
+13
View File
@@ -0,0 +1,13 @@
piVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-external-idp
spec:
egress:
- toFQDNs:
- matchName: login.microsoftonline.com
- matchName: graph.microsoft.com
- matchName: s3.k1.itpartner.no
- matchName: telemetry.cerbos.dev
endpointSelector: {}
policies/oceanbox/network/idp/allow-itp-smtpgw.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-itp-smtp
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: keycloak
egress:
- toFQDNs:
- matchName: smtpgw.itpartner.no
policies/oceanbox/network/idp/allow-keycloak.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-keycloak
namespace: idp
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: dex
egress:
- toFQDNs:
- matchName: auth.srv.oceanbox.io
policies/oceanbox/network/jaeger/allow-api-server.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-kube-api
namespace: jaeger
spec:
endpointSelector:
matchLabels: {}
egress:
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "6443"
protocol: TCP
policies/oceanbox/network/jaeger/allow-remote-node.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-remote-node-webhooks
namespace: jaeger
spec:
endpointSelector:
matchLabels: {}
ingress:
- fromEntities:
- kube-apiserver
- toPorts:
- ports:
- port: "9443"
protocol: TCP
- port: "443"
protocol: TCP
policies/oceanbox/network/microsoftonline.nix
+21
View File
@@ -0,0 +1,21 @@
{ ... }:
{
applications.netpol-microsoftonline = {
project = "netpol";
resources = {
ciliumClusterwideNetworkPolicies = {
allow-microsoftonline.spec = {
endpointSelector = { };
egress = [
{
toFQDNs = [
{ matchName = "login.microsoftonline.com"; }
{ matchPattern = "*.microsoftonline.com"; }
];
}
];
};
};
};
};
}
policies/oceanbox/network/rabbitmq/policy-allow-rabbitmq.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-world-to-rabbitmq-http
namespace: rabbitmq
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: rabbitmq
ingress:
- fromEntities:
- world
- toPorts:
- ports:
- port: "15672"
protocol: TCP
policies/oceanbox/network/templ.nix
+11
View File
@@ -0,0 +1,11 @@
{ ... }:
{
applications.xxx = {
resources = {
ciliumClusterwideNetworkPolicies = {
xxx.spec = {
};
};
};
};
}