wip: try nixidy

2024-10-10 16:04:41 +02:00
parent 61379ad665
commit 11b398801d
66 changed files with 55100 additions and 0 deletions
@@ -1,20 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: add-ingress-whitelist
-spec:
-  background: true
-  generateExisting: true
-  rules:
-  - name: set-whitelist-internal
-    mutate:
-      patchStrategicMerge:
-        metadata:
-          annotations:
-            nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
-    match:
-      resources:
-        kinds:
-        - Ingress
-        annotations:
-          atlantis.oceanbox.io/expose: internal
@@ -1,31 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: remove-argocd-tracking-id
-spec:
-  background: true
-  generateExisting: true
-  rules:
-  - name: remove-argocd-tracking-ids
-    mutate:
-      patchesJson6902: |-
-        - path: /metadata/annotations/argocd.argoproj.io~1tracking-id
-          op: remove
-    match:
-      any:
-       - resources:
-           kinds:
-           - Secret
-           names:
-           - prod-rabbitmq
-           - staging-rabbitmq
-           - prod-redis
-           - staging-redis
-    exclude:
-      any:
-       - resources:
-           kinds:
-           - Namespace
-           names:
-           - rabbitmq
-           - redis
@@ -1,111 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: sync-dev-atlantis-secrets
-spec:
-  background: true
-  generateExisting: false
-  rules:
-  - name: sync-rabbitmq-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: staging-rabbitmq
-        namespace: rabbitmq
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - "*-rabbitmq"
-         annotations:
-           kyverno/clone: "true"
-  - name: sync-redis-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: staging-redis
-        namespace: redis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - "*-redis"
-         annotations:
-           kyverno/clone: "true"
-  - name: sync-archmaester-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: prod-archmeister-superuser
-        namespace: atlantis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - "*-db-superuser"
-         annotations:
-           kyverno/clone: "true"
-  - name: sync-archmaester-replication-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: prod-archmeister-replication
-        namespace: atlantis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - prod-archmeister-replication
-         annotations:
-           kyverno/clone: "true"
-  - name: sync-archmaester-ca
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: prod-archmeister-ca
-        namespace: atlantis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - prod-archmeister-ca
-         annotations:
-           kyverno/clone: "true"
-    # exclude:
-    #  any:
-    #  - resources:
-    #      kinds:
-    #      - Secret
-    #      selector:
-    #        matchLabels:
-    #          generate.kyverno.io/clone-source: ""
@@ -1,44 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    policies.kyverno.io/category: Sample
-    policies.kyverno.io/description: 'Secrets like registry credentials often need
-      to exist in multiple Namespaces so Pods there have access. Manually duplicating
-      those Secrets is time consuming and error prone. This policy will copy a Secret
-      called `regcred` which exists in the `default` Namespace to new Namespaces when
-      they are created. It will also push updates to the copied Secrets should the
-      source Secret be changed.            '
-  creationTimestamp: "2024-01-15T11:58:24Z"
-  name: sync-oceanbox-regcred
-spec:
-  admission: true
-  background: true
-  generateExisting: true
-  rules:
-  - generate:
-      apiVersion: v1
-      clone:
-        # name: oceanbox-regcred
-        name: gitlab-pull-secret
-        namespace: default
-      kind: Secret
-      # name: oceanbox-regcred
-      name: gitlab-pull-secret
-      namespace: '{{request.object.metadata.name}}'
-      synchronize: true
-    exclude:
-      any:
-      - resources:
-          kinds:
-          - Namespace
-          names:
-          - "vcluster-*"
-    match:
-      any:
-      - resources:
-          kinds:
-          - Namespace
-    name: sync-oceanbox-regcred
-
-
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-ceph-egress
-spec:
-  egress:
-  - toCIDR:
-    - 10.255.241.30/32
-    - 10.255.241.31/32
-    - 10.255.241.32/32
-    - 10.255.244.0/24
-    # toPorts:
-    # - ports:
-    #   - port: "4443"
-    #     protocol: TCP
-  endpointSelector: {}
-
@@ -1,13 +0,0 @@
-piVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-external-idp
-spec:
-  egress:
-  - toFQDNs:
-    - matchName: login.microsoftonline.com
-    - matchName: graph.microsoft.com
-    - matchName: s3.k1.itpartner.no
-    - matchName: telemetry.cerbos.dev
-  endpointSelector: {}
-
@@ -1,10 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-microsoft-oidc-login
-spec:
-  endpointSelector: {}
-  egress:
-  - toFQDNs:
-    - matchName: login.microsoftonline.com
-    - matchPattern: '*.microsoftonline.com'
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: atlantis
-spec:
-  endpointSelector:
-    matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
-    toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP
@@ -1,10 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-kube-apiserver
-spec:
-  endpointSelector:
-    matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-ekman-egress
-spec:
-  endpointSelector: {}
-  egress:
-  - toCIDR:
-    - 10.255.241.99/32
-    - 10.255.241.100/32
-    toPorts:
-    - ports:
-      - port: "4443"
-        protocol: TCP
-      - port: "30443"
-        protocol: TCP
-      - port: "30080"
-        protocol: TCP
@@ -1,28 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-namespace-traffic
-spec:
-  description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
-  endpointSelector: {}
-  ingress:
-    - fromEndpoints:
-      - matchExpressions:
-        - key: io.kubernetes.pod.namespace
-          operator: Exists
-  egress:
-    - toEndpoints:
-      - matchExpressions:
-        - key: io.kubernetes.pod.namespace
-          operator: Exists
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: "*"
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-oceanboxio-egress
-spec:
-  endpointSelector: {}
-  egress:
-  - toFQDNs:
-    - matchName: oceanbox.io
-    - matchName: hubble.srv.oceanbox.io
-    - matchPattern: "*oceanbox.io"
-    - matchPattern: "*.oceanbox.io"
-
@@ -1,10 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-  - fromEntities:
-    - kube-apiserver
@@ -1,16 +0,0 @@
-apiVersion: "cilium.io/v2"
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-port-9070
-  namespace: csi-addons-system
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: csi-addons
-  egress:
-  - toEntities:
-    - host
-    toPorts:
-    - ports:
-      - port: "9070"
-        protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: dapr-system
-spec:
-  endpointSelector:
-    matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
-    toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: dapr-system
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-  - fromEntities:
-    - kube-apiserver
-    - remote-node
-  - toPorts:
-    - ports:
-      - port: "4000"
-        protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-geoserver-ingress
-  namespace: geoserver
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: geoserver
-  ingress:
-    - fromEndpoints:
-      - matchLabels:
-          io.kubernetes.pod.namespace: ingress-nginx
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: idp
-spec:
-  endpointSelector:
-    matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
-    toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-oidc-login
-  namespace: idp
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: cerbos
-  egress:
-  - toFQDNs:
-    - matchName: gitlab.com
-    - matchPattern: '*.gitlab.com'
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-itp-smtp
-  namespace: idp
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: keycloak
-  egress:
-  - toFQDNs:
-    - matchName: smtpgw.itpartner.no
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-keycloak
-  namespace: idp
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: dex
-  egress:
-  - toFQDNs:
-    - matchName: auth.srv.oceanbox.io
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: jaeger
-spec:
-  endpointSelector:
-    matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
-    toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: jaeger
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-  - fromEntities:
-    - kube-apiserver
-  - toPorts:
-    - ports:
-      - port: "9443"
-        protocol: TCP
-      - port: "443"
-        protocol: TCP
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-rabbitmq-http
-  namespace: rabbitmq
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: rabbitmq
-  ingress:
-  - fromEntities:
-    - world
-  - toPorts:
-    - ports:
-      - port: "15672"
-        protocol: TCP
-