fix: misc attempts at fixing UR loops in kyverno

resources/atlantis/host-manifests/allow-atlantis-external-services.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-atlantis-external-services
+  namespace: atlantis
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: api.github.com
+    - matchName: dapr.github.io
+    - matchName: gitlab.com
+    - matchPattern: '*.gitlab.com'
+    - matchPattern: "*.k1.itpartner.no"
+    - matchName: analytics.loft.rocks
+  endpointSelector:
+    matchLabels: {}

resources/atlantis/host-manifests/allow-atlantis-services.yaml

@@ -1,22 +1,5 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
-metadata:
-  name: allow-external-services
-  namespace: atlantis
-spec:
-  egress:
-  - toFQDNs:
-    - matchName: api.github.com
-    - matchName: dapr.github.io
-    - matchName: gitlab.com
-    - matchPattern: '*.gitlab.com'
-    - matchPattern: "*.k1.itpartner.no"
-    - matchName: analytics.loft.rocks
-  endpointSelector:
-    matchLabels: {}
----
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
 metadata:
   name: allow-atlantis-services
   namespace: atlantis

resources/atlantis/host-manifests/sync-rabbitmq-secrets.yaml

@@ -1,12 +1,12 @@
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
-  name: sync-rabbitmq-secret
+  name: sync-rabbitmq-secrets
 spec:
   background: true
   generateExisting: true
   rules:
-  - name: sync-rabbitmq-secret
+  - name: sync-prod-rabbitmq-secret
     generate:
       apiVersion: v1
       kind: Secret

resources/oceanbox-cluster/allow-namespace-traffic.yaml

@@ -0,0 +1,15 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "allow-namespace-traffic"
+specs:
+  - endpointSelector:
+      matchLabels: {}
+    egress:
+    - toEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": argocd
+    ingress:
+    - fromEndpoints:
+      - matchLabels:
+          "k8s:io.kubernetes.pod.namespace": argocd

resources/oceanbox-cluster/sync-oceanbox-regcred.yaml

@@ -0,0 +1,36 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Sample
+    policies.kyverno.io/description: 'Secrets like registry credentials often need
+      to exist in multiple Namespaces so Pods there have access. Manually duplicating
+      those Secrets is time consuming and error prone. This policy will copy a Secret
+      called `regcred` which exists in the `default` Namespace to new Namespaces when
+      they are created. It will also push updates to the copied Secrets should the
+      source Secret be changed.            '
+  creationTimestamp: "2024-01-15T11:58:24Z"
+  name: sync-oceanbox-regcred
+spec:
+  admission: true
+  background: true
+  rules:
+  - generate:
+      apiVersion: v1
+      clone:
+        # name: oceanbox-regcred
+        name: gitlab-pull-secret
+        namespace: default
+      kind: Secret
+      # name: oceanbox-regcred
+      name: gitlab-pull-secret
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+    match:
+      resources:
+        kinds:
+        - Namespace
+    name: sync-image-pull-secret
+    # skipBackgroundRequests: true
+  # validationFailureAction: audit
+

vcluster/chart/templates/allow-vcluster-atlantis-services.yaml

@@ -11,14 +11,15 @@ spec:
     generate:
       apiVersion: cilium.io/v2
       kind: CiliumNetworkPolicy
-      name: allow-atlantis-services
+      name: "allow-{{ $name }}-atlantis-services"
       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
       synchronize: true
       clone:
         namespace: atlantis
         name: allow-atlantis-services
     match:
-      resources:
+      any:
+      - resources:
           kinds:
           - Namespace
           names:

vcluster/chart/templates/generate-cnp-rules.yaml

@@ -1,5 +1,5 @@
 {{- $fullname := include "vCluster.fullname" . -}}
-{{- $name := include "vCluster.fullname" . -}}
+{{- $name := include "vCluster.releaseName" . -}}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -9,23 +9,20 @@ metadata:
     policies.kyverno.io/minversion: 1.7.0
     policies.kyverno.io/subject: Namespace, NetworkPolicy
     policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
-  name: generate-vcluster-apiserver-networkpolicy
+  name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
   namespace: {{ .Release.Namespace }}
 spec:
   background: true
   generateExisting: true
   rules:
-  - name: generate-vcluster-apiserver-networkpolicy
+  - name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
     generate:
       apiVersion: cilium.io/v2
       kind: CiliumNetworkPolicy
-      name: allow-vcluster-apiserver-access
+      name: allow-{{ $name }}-vcluster-apiserver-access
       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
       synchronize: true
       data:
-        metadata:
-          labels:
-            created-by: kyverno
         spec:
           description: Allow egress to vcluster kube-apiserver
           egress:
@@ -50,4 +47,3 @@ spec:
           selector:
             matchLabels:
               vcluster.loft.sh/vcluster-name: {{ $fullname }}
-

vcluster/chart/templates/sync-vcluster-atlantis-secrets.yaml

@@ -1,66 +1,66 @@
-{{- $name := include "vCluster.releaseName" . -}}
+# {{- $name := include "vCluster.releaseName" . -}}
-apiVersion: kyverno.io/v1
+# apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+# kind: ClusterPolicy
-metadata:
+# metadata:
-  name: "sync-{{ $name }}-vcluster-secrets"
+#   name: "sync-{{ $name }}-vcluster-secrets"
-spec:
+# spec:
-  background: true
+#   background: true
-  generateExisting: true
+#   generateExisting: true
-  rules:
+#   rules:
-  - name: sync-rabbitmq-secrets
+#   - name: sync-rabbitmq-secrets
-    generate:
+#     generate:
-      apiVersion: v1
+#       apiVersion: v1
-      kind: Secret
+#       kind: Secret
-      name: staging-rabbitmq
+#       name: staging-rabbitmq
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
+#       synchronize: true
-      clone:
+#       clone:
-        namespace: rabbitmq
+#         namespace: rabbitmq
-        name: staging-rabbitmq
+#         name: staging-rabbitmq
-    match:
+#     match:
-      resources:
+#       resources:
-        kinds:
+#         kinds:
-        - Namespace
+#         - Namespace
-        names:
+#         names:
-          - "vcluster-009dba7e-*"
+#           - "vcluster-009dba7e-*"
-        selector:
+#         selector:
-          matchLabels:
+#           matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-redis-secrets
+#   - name: sync-redis-secrets
-    generate:
+#     generate:
-      apiVersion: v1
+#       apiVersion: v1
-      kind: Secret
+#       kind: Secret
-      name: staging-redis
+#       name: staging-redis
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
+#       synchronize: true
-      clone:
+#       clone:
-        namespace: redis
+#         namespace: redis
-        name: staging-redis
+#         name: staging-redis
-    match:
+#     match:
-      resources:
+#       resources:
-        kinds:
+#         kinds:
-        - Namespace
+#         - Namespace
-        names:
+#         names:
-          - "vcluster-009dba7e-*"
+#           - "vcluster-009dba7e-*"
-        selector:
+#         selector:
-          matchLabels:
+#           matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-archmeister-superuser
+#   - name: sync-archmeister-superuser
-    generate:
+#     generate:
-      apiVersion: v1
+#       apiVersion: v1
-      kind: Secret
+#       kind: Secret
-      name: '{{ $name }}-archmeister-app'
+#       name: '{{ $name }}-archmeister-app'
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
+#       synchronize: true
-      clone:
+#       clone:
-        namespace: '{{ .Release.Namespace }}'
+#         namespace: '{{ .Release.Namespace }}'
-        name: '{{ $name }}-archmeister-superuser'
+#         name: '{{ $name }}-archmeister-superuser'
-    match:
+#     match:
-      resources:
+#       resources:
-        kinds:
+#         kinds:
-        - Namespace
+#         - Namespace
-        names:
+#         names:
-          - "vcluster-009dba7e-*"
+#           - "vcluster-009dba7e-*"
-        selector:
+#         selector:
-          matchLabels:
+#           matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'