fix: misc attempts at fixing UR loops in kyverno

This commit is contained in:
2024-02-18 21:09:09 +01:00
parent 667bdf3ac0
commit 5793244141
8 changed files with 148 additions and 101 deletions
@@ -1,5 +1,5 @@
{{- $fullname := include "vCluster.fullname" . -}}
{{- $name := include "vCluster.fullname" . -}}
{{- $name := include "vCluster.releaseName" . -}}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
@@ -9,23 +9,20 @@ metadata:
policies.kyverno.io/minversion: 1.7.0
policies.kyverno.io/subject: Namespace, NetworkPolicy
policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
name: generate-vcluster-apiserver-networkpolicy
name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
namespace: {{ .Release.Namespace }}
spec:
background: true
generateExisting: true
rules:
- name: generate-vcluster-apiserver-networkpolicy
- name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
generate:
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
name: allow-vcluster-apiserver-access
name: allow-{{ $name }}-vcluster-apiserver-access
namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
synchronize: true
data:
metadata:
labels:
created-by: kyverno
spec:
description: Allow egress to vcluster kube-apiserver
egress:
@@ -50,4 +47,3 @@ spec:
selector:
matchLabels:
vcluster.loft.sh/vcluster-name: {{ $fullname }}