fix: misc attempts at fixing UR loops in kyverno

resources/atlantis/host-manifests/allow-atlantis-external-services.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-atlantis-external-services
+  namespace: atlantis
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: api.github.com
+    - matchName: dapr.github.io
+    - matchName: gitlab.com
+    - matchPattern: '*.gitlab.com'
+    - matchPattern: "*.k1.itpartner.no"
+    - matchName: analytics.loft.rocks
+  endpointSelector:
+    matchLabels: {}

resources/atlantis/host-manifests/allow-atlantis-services.yaml

@@ -1,22 +1,5 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
-metadata:
-  name: allow-external-services
-  namespace: atlantis
-spec:
-  egress:
-  - toFQDNs:
-    - matchName: api.github.com
-    - matchName: dapr.github.io
-    - matchName: gitlab.com
-    - matchPattern: '*.gitlab.com'
-    - matchPattern: "*.k1.itpartner.no"
-    - matchName: analytics.loft.rocks
-  endpointSelector:
-    matchLabels: {}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
 metadata:
   name: allow-atlantis-services
   namespace: atlantis

resources/atlantis/host-manifests/sync-rabbitmq-secrets.yaml

@@ -1,12 +1,12 @@
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
-  name: sync-rabbitmq-secret
+  name: sync-rabbitmq-secrets
 spec:
   background: true
   generateExisting: true
   rules:
-  - name: sync-rabbitmq-secret
+  - name: sync-prod-rabbitmq-secret
     generate:
       apiVersion: v1
       kind: Secret

resources/oceanbox-cluster/allow-namespace-traffic.yaml

@@ -0,0 +1,15 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "allow-namespace-traffic"
+specs:
+  - endpointSelector:
+      matchLabels: {}
+    egress:
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": argocd
+    ingress:
+    - fromEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": argocd

resources/oceanbox-cluster/sync-oceanbox-regcred.yaml

@@ -0,0 +1,36 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Sample
+    policies.kyverno.io/description: 'Secrets like registry credentials often need
+      to exist in multiple Namespaces so Pods there have access. Manually duplicating
+      those Secrets is time consuming and error prone. This policy will copy a Secret
+      called `regcred` which exists in the `default` Namespace to new Namespaces when
+      they are created. It will also push updates to the copied Secrets should the
+      source Secret be changed.            '
+  creationTimestamp: "2024-01-15T11:58:24Z"
+  name: sync-oceanbox-regcred
+spec:
+  admission: true
+  background: true
+  rules:
+  - generate:
+      apiVersion: v1
+      clone:
+        # name: oceanbox-regcred
+        name: gitlab-pull-secret
+        namespace: default
+      kind: Secret
+      # name: oceanbox-regcred
+      name: gitlab-pull-secret
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+    match:
+      resources:
+        kinds:
+        - Namespace
+    name: sync-image-pull-secret
+    # skipBackgroundRequests: true
+  # validationFailureAction: audit
+