fix: misc attempts at fixing UR loops in kyverno
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
{{- $fullname := include "vCluster.fullname" . -}}
|
||||
{{- $name := include "vCluster.fullname" . -}}
|
||||
{{- $name := include "vCluster.releaseName" . -}}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
@@ -9,23 +9,20 @@ metadata:
|
||||
policies.kyverno.io/minversion: 1.7.0
|
||||
policies.kyverno.io/subject: Namespace, NetworkPolicy
|
||||
policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
|
||||
name: generate-vcluster-apiserver-networkpolicy
|
||||
name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
background: true
|
||||
generateExisting: true
|
||||
rules:
|
||||
- name: generate-vcluster-apiserver-networkpolicy
|
||||
- name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
|
||||
generate:
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
name: allow-vcluster-apiserver-access
|
||||
name: allow-{{ $name }}-vcluster-apiserver-access
|
||||
namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
|
||||
synchronize: true
|
||||
data:
|
||||
metadata:
|
||||
labels:
|
||||
created-by: kyverno
|
||||
spec:
|
||||
description: Allow egress to vcluster kube-apiserver
|
||||
egress:
|
||||
@@ -50,4 +47,3 @@ spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
vcluster.loft.sh/vcluster-name: {{ $fullname }}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user