refactor: move general resources to separte top-level folder

2024-02-08 15:22:48 +01:00
parent a41aba8615
commit 54a95e486d
9 changed files with 38 additions and 5 deletions
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-loft-analytics
+  namespace: atlantis
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: analytics.loft.rocks
+  endpointSelector:
+    matchLabels:
+      app: vcluster
@@ -0,0 +1,79 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: sync-atlantis-secrets
+spec:
+  background: true
+  generateExistingOnPolicyUpdate: true
+  rules:
+  - name: sync-redis-secrets
+    generate:
+      apiVersion: v1
+      namespace: atlantis
+      synchronize: true
+      cloneList:
+        namespace: redis
+        kinds:
+          - Secret
+        selector:
+          matchLabels:
+            app.kubernetes.io/name: redis
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+        - atlantis
+        - '*-vcluster'
+  - name: sync-rabbitmq-secrets
+    generate:
+      apiVersion: v1
+      namespace: atlantis
+      synchronize: true
+      cloneList:
+        namespace: rabbitmq
+        kinds:
+          - Secret
+        selector:
+          matchLabels:
+            clone: "true"
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+        - atlantis
+        - '*-vcluster'
+  - name: sync-archmeister-replication-ca
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: prod-archmeister-ca
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+      clone:
+        namespace: atlantis
+        name: prod-archmeister-ca
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+        - '*-vcluster'
+  - name: sync-archmeister-replication-replication
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: prod-archmeister-replication
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+      clone:
+        namespace: atlantis
+        name: prod-archmeister-replication
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+        - '*-vcluster'
+  validationFailureAction: audit
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-atlantis-services
+  namespace: atlantis
+spec:
+  egress:
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": dapr-system
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": redis
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": rabbitmq
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": jaeger
+  endpointSelector:
+    matchLabels: {}
+
+
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-external-s3
+  namespace: atlantis
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: s3.k1.itpartner.no
+  endpointSelector:
+    matchLabels: {}
+
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-external-services
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: gitlab.com
+    - matchPattern: '*.gitlab.com'
+    - matchName: api.github.com
+  endpointSelector:
+    matchLabels: {}
@@ -0,0 +1,24 @@
+apiVersion: jaegertracing.io/v1
+kind: "Jaeger"
+metadata:
+  name: jaeger
+spec:
+  strategy: allInOne
+  ingress:
+    enabled: false
+  allInOne:
+    image: jaegertracing/all-in-one:1.22
+    options:
+      query:
+        base-path: /jaeger
+---
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: tracing
+spec:
+  tracing:
+    samplingRate: "1"
+    zipkin:
+      endpointAddress: "http://jaeger-collector:9411/api/v2/spans"
+