devel: Remove attic
It's now available on the attic branch.
This commit is contained in:
@@ -1,26 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
*.nix
|
||||
old/
|
||||
nix/
|
||||
@@ -1,27 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: sys
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
dependencies: # A list of the chart requirements (optional)
|
||||
- name: sys-cilium-policies
|
||||
condition: cilium.enabled
|
||||
@@ -1,23 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: cilium
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-applicationset-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-notifications
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD Notifications
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: slack.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access-applicationset
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo Applicationset
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo server
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: repo-server
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-chartmuseum-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the chartmuseum ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: chartmuseum
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-image-updater-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD image updater to access github container registry
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: ghcr.io
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-image-updater
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-microsoft-sso
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: github.com
|
||||
- matchName: api.github.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-rollout
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-rollouts
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8090"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-workflows
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-workflows
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
-30
@@ -1,30 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argocd
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8082"
|
||||
protocol: TCP
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
- port: "9001"
|
||||
protocol: TCP
|
||||
- port: "9121"
|
||||
protocol: TCP
|
||||
- port: "8084"
|
||||
protocol: TCP
|
||||
- port: "8083"
|
||||
protocol: TCP
|
||||
- port: "5558"
|
||||
protocol: TCP
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server-to-cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the API server to communicate with the cert-manager pods
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the Kube API server to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9402"
|
||||
protocol: TCP
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-traffic
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the world to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8081"
|
||||
protocol: TCP
|
||||
@@ -1,22 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cilium-test
|
||||
spec:
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- {}
|
||||
- toEntities:
|
||||
- cluster
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
- fromEntities:
|
||||
- world
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-acme-solvers
|
||||
spec:
|
||||
description: Policy for ingress for Acme Solvers.
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
acme.cert-manager.io/http01-solver: "true"
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-24
@@ -1,24 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns
|
||||
spec:
|
||||
description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: NotIn
|
||||
values:
|
||||
- kube-system
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-mariadb-operator
|
||||
spec:
|
||||
description: allow mariadb instances to be reached by operator
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: mariadb
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/name: mariadb-operator
|
||||
io.kubernetes.pod.namespace: mariadb-operator
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "3306"
|
||||
protocol: TCP
|
||||
-20
@@ -1,20 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-s3-traffic
|
||||
spec:
|
||||
description: Policy for egress for CNPG Backups.
|
||||
egress:
|
||||
- toFQDNs:
|
||||
{{- range .Values.s3.hosts }}
|
||||
- matchName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- range .Values.s3.patterns }}
|
||||
- matchPattern: {{ . | quote }}
|
||||
{{- end }}
|
||||
- toCIDR:
|
||||
{{- range .Values.s3.cidr }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: cilium-health-checks
|
||||
spec:
|
||||
description: Health checks
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
reserved:health: ""
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,9 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: deny-all
|
||||
spec:
|
||||
description: Deny all
|
||||
egress: []
|
||||
endpointSelector: {}
|
||||
ingress: []
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cnpg
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: postgres-operator
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: cnpg
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kube-downscaler
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
application: downscaler-py-kube-downscaler
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: kube-downscaler
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- host
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchPattern: hubble.*.*.*
|
||||
- matchPattern: hubble.*.*.*.*
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9913"
|
||||
protocol: TCP
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-s3-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toCIDR:
|
||||
- 10.139.2.10/32
|
||||
- toCIDR:
|
||||
- 10.139.2.11/32
|
||||
- toCIDR:
|
||||
- 10.139.2.20/32
|
||||
- toCIDR:
|
||||
- 10.139.2.21/32
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-to-ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: jaeger
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-jaeger
|
||||
namespace: jaeger
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: jaeger-operator
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kafka
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kafka-operator
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: kafka
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-controller-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Controller Metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-controller-manager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "10257"
|
||||
protocol: TCP
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-csi-webhook
|
||||
namespace: kube-system
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: csi-snapshot-webhook
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9153"
|
||||
protocol: TCP
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns-world
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS World
|
||||
egress:
|
||||
- toCIDR:
|
||||
- 8.8.8.8/32
|
||||
- 172.31.254.11/32
|
||||
- 1.1.1.1/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
- toEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: Exists
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Host Traffic
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- host
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-ingress
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-ui
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-oauth2-ingress
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble OAuth2 ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: oauth2-proxy
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-relay-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble Relay Metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-relay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9966"
|
||||
protocol: TCP
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-microsoft-sso
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Microsoft SSO
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: graph.microsoft.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: oauth2-proxy
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-namespace-traffic
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Namespace Traffic
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- {}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- {}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-proxy-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Proxy metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-proxy
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "10249"
|
||||
protocol: TCP
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: kubelet-serving-cert-approver
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kyverno
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: kyverno
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kyverno
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "8000"
|
||||
protocol: TCP
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-kyverno
|
||||
namespace: kyverno
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kyverno
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-loki-backend-to-api-server
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Promtail needs to reach kube-apiserver
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: backend
|
||||
app.kubernetes.io/instance: loki
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Allow Prometheus read and write
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: loki
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "3100"
|
||||
protocol: TCP
|
||||
- port: "3500"
|
||||
protocol: TCP
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-promtail-to-api-server
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Promtail needs to reach kube-apiserver
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: promtail
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-stats-grafana
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Allow stats
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: stats.grafana.org
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: loki
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: mariadb-operator
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: mariadb-operator
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-to-mariadb
|
||||
namespace: mariadb-operator
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: mariadb-operator
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- host
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: mariadb-operator
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: mariadb-operator
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: mariadb-operator
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: mayastor
|
||||
spec:
|
||||
description: Allow Host Traffic
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- host
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-agent-core
|
||||
namespace: mayastor
|
||||
spec:
|
||||
description: Allow Remote to Agent Core
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: agent-core
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-etcd
|
||||
namespace: mayastor
|
||||
spec:
|
||||
description: Allow Remote to Etcd
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: etcd
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-maya
|
||||
namespace: mayastor
|
||||
spec:
|
||||
description: Allow Remote to Mayastor
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: api-rest
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: minio
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-minio-operator
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: minio
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: minio-operator
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9000"
|
||||
protocol: TCP
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-nodeport-ingress
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: minio
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9000"
|
||||
protocol: TCP
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: minio-operator
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: odigos-system
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-port-4317
|
||||
namespace: odigos-system
|
||||
spec:
|
||||
egress:
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "4317"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: one-password
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: one-password-operator
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: one-password
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: opencost
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: opencost
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-otel-collector-loadbalancer-ingress
|
||||
namespace: otel
|
||||
spec:
|
||||
description: Allow ingress from world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: opentelemetry-collector
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-mail-egress
|
||||
namespace: postfix
|
||||
spec:
|
||||
description: Allow mailserver to send mails to world
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: smtp-relay
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-mail-ingress
|
||||
namespace: postfix
|
||||
spec:
|
||||
description: Allow all services in cluster to send mail
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: smtp-relay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: Exists
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "25"
|
||||
protocol: TCP
|
||||
- port: "587"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: postfix
|
||||
spec:
|
||||
description: 'Allow prometheus metrics '
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: smtp-relay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9154"
|
||||
protocol: TCP
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-alerting
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow alerting
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: prom-alertmanager
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-alertmanager-ingress
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Nginx ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: alertmanager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns-metrics
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow DNS metrics
|
||||
egress:
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9153"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: prometheus
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-etcd-metrics
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow ETCD metrics
|
||||
egress:
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "2379"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: prometheus
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-grafana-ingress
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Grafana ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-16
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-grafana-oidc-login
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Grafana OIDC login
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: api.github.com
|
||||
- matchName: github.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-grafana-plugins
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Grafana Plugins
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: grafana.com
|
||||
- matchName: storage.googleapis.com
|
||||
- matchName: raw.githubusercontent.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-grafana-secure-gravatar
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Grafana Secure Gravatar
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: secure.grafana.com
|
||||
- matchName: secure.gravatar.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Host Traffic
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- host
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-nginx-ingress
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Nginx ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: prometheus
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-opencost-scrape
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow OpenCost scrape
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: prometheus
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/name: opencost
|
||||
io.kubernetes.pod.namespace: opencost
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-metrics-server
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Remote Metrics Server
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: metrics-server
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-webhook
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Remote Web Hook
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: kube-prometheus-stack-operator
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-robusta-ingress
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow Robusta ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: prom-prometheus
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: robusta
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-stats-grafana
|
||||
namespace: prometheus
|
||||
spec:
|
||||
description: Allow stats
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: stats.grafana.org
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
-52
@@ -1,52 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-inter-node-traffic
|
||||
namespace: rabbitmq
|
||||
spec:
|
||||
description: Allow communication between nodes int the RabbitMQ cluster
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/component: rabbitmq
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4369"
|
||||
- endPort: 6500
|
||||
port: "6000"
|
||||
- port: "25672"
|
||||
- port: "35672"
|
||||
- port: "35673"
|
||||
- port: "35674"
|
||||
- port: "35675"
|
||||
- port: "35676"
|
||||
- port: "35677"
|
||||
- port: "35678"
|
||||
- port: "35679"
|
||||
- port: "35680"
|
||||
- port: "35681"
|
||||
- port: "35682"
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: rabbitmq
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/component: rabbitmq
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4369"
|
||||
- endPort: 6500
|
||||
port: "6000"
|
||||
- port: "25672"
|
||||
- port: "35672"
|
||||
- port: "35673"
|
||||
- port: "35674"
|
||||
- port: "35675"
|
||||
- port: "35676"
|
||||
- port: "35677"
|
||||
- port: "35678"
|
||||
- port: "35679"
|
||||
- port: "35680"
|
||||
- port: "35681"
|
||||
- port: "35682"
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-operator-traffic
|
||||
namespace: rabbitmq
|
||||
spec:
|
||||
description: Allow access to the RabbitMQ operator
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: rabbitmq
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/component: rabbitmq-operator
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "15672"
|
||||
- port: "15671"
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user