fix: update vcluster adn remove kyverno policies

charts/vcluster/templates/allow-external-services.yaml

@@ -6,9 +6,9 @@ metadata:
 spec:
   egress:
   - toFQDNs:
-    - matchName: api.github.com
     - matchName: dapr.github.io
-    - matchName: gitlab.com
     - matchName: analytics.loft.rocks
+    # - matchName: gitlab.com
+    # - matchName: api.github.com
   endpointSelector:
     matchLabels: {}

charts/vcluster/templates/cnpg.yaml

@@ -24,7 +24,7 @@ spec:
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: staging-archmeister
+  name: {{ $name }}-archmaester
   namespace: {{ .Release.Namespace }}
   annotations:
     linkerd.io/inject: disabled
@@ -54,7 +54,7 @@ spec:
   externalClusters:
   - name: prod-archmeister
     connectionParameters:
-      host: prod-archmeister-rw.atlantis.svc
+      host: prod-archmeister-rw.atlantis
       user: streaming_replica
       sslmode: verify-full
     sslKey:

charts/vcluster/templates/kyverno-policies/allow-vcluster-apiserver.yaml

@@ -1,49 +0,0 @@
-{{- $fullname := include "vCluster.fullname" . -}}
-{{- $name := include "vCluster.releaseName" . -}}
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    kyverno.io/kyverno-version: 1.7.0
-    policies.kyverno.io/description:  Allow egress to vcluster kube-apiserver
-    policies.kyverno.io/minversion: 1.7.0
-    policies.kyverno.io/subject: Namespace, NetworkPolicy
-    policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
-  name: allow-{{ $name }}-vcluster-apiserver
-  namespace: {{ .Release.Namespace }}
-spec:
-  background: true
-  generateExisting: true
-  rules:
-  - name: allow-{{ $name }}-vcluster-apiserver
-    generate:
-      apiVersion: cilium.io/v2
-      kind: CiliumNetworkPolicy
-      name: allow-{{ $name }}-vcluster-apiserver-access
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
-      data:
-        spec:
-          description: Allow egress to vcluster kube-apiserver
-          egress:
-          - toEndpoints:
-            - matchLabels:
-               app: vcluster
-            toPorts:
-            - ports:
-              - port: "443"
-                protocol: TCP
-          endpointSelector: {}
-    match:
-      any:
-      - resources:
-          kinds:
-          - Namespace
-          names:
-          - {{ $fullname }}
-      - resources:
-          kinds:
-          - Namespace
-          selector:
-            matchLabels:
-              vcluster.loft.sh/vcluster-name: {{ $fullname }}

charts/vcluster/templates/kyverno-policies/sync-vcluster-atlantis-secrets.yaml

@@ -1,66 +0,0 @@
-{{- $name := include "vCluster.releaseName" . -}}
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: "sync-{{ $name }}-vcluster-secrets"
-spec:
-  background: true
-  generateExisting: true
-  rules:
-  - name: sync-rabbitmq-secrets
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: staging-rabbitmq
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: false
-      clone:
-        namespace: rabbitmq
-        name: staging-rabbitmq
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-redis-secrets
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: staging-redis
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: false
-      clone:
-        namespace: redis
-        name: staging-redis
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-archmeister-app-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: staging-archmeister-app
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: false
-      clone:
-        namespace: '{{ .Release.Namespace }}'
-        name: staging-archmeister-superuser
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'

charts/vcluster/templates/kyverno-policies/sync-vcluster-oceanbox-regcred.yaml

@@ -1,40 +0,0 @@
-{{- $fullname := include "vCluster.fullname" . -}}
-{{- $name := include "vCluster.releaseName" . -}}
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  annotations:
-    policies.kyverno.io/category: Sample
-    policies.kyverno.io/description: 'Secrets like registry credentials often need
-      to exist in multiple Namespaces so Pods there have access. Manually duplicating
-      those Secrets is time consuming and error prone. This policy will copy a Secret
-      called `regcred` which exists in the `default` Namespace to new Namespaces when
-      they are created. It will also push updates to the copied Secrets should the
-      source Secret be changed.            '
-  creationTimestamp: "2024-01-15T11:58:24Z"
-  name: sync-{{ $name }}-vcluster-oceanbox-regcred
-spec:
-  admission: true
-  background: true
-  generateExisting: true
-  rules:
-  - generate:
-      apiVersion: v1
-      clone:
-        # name: oceanbox-regcred
-        name: gitlab-pull-secret
-        namespace: default
-      kind: Secret
-      # name: oceanbox-regcred
-      name: gitlab-pull-secret
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: false
-    match:
-      any:
-      - resources:
-          kinds:
-          - Namespace
-          selector:
-            matchLabels:
-              vcluster.loft.sh/vcluster-name: {{ $fullname }}
-    name: sync-vcluster-oceanbox-regcred

charts/vcluster/templates/vcluster.yaml

@@ -16,7 +16,7 @@ spec:
     namespace: {{ .Release.Namespace }}
   source:
     repoURL: https://charts.loft.sh
-    targetRevision: 0.19.5
+    targetRevision: 0.20.1
     chart: vcluster
     helm:
       values: |-
@@ -63,12 +63,10 @@ spec:
 
           mapServices:
             fromHost:
-            - from: "redis/{{ .Values.environment }}-redis-master"
-              to: "redis/{{ .Values.environment }}-redis-master"
             - from: "rabbitmq/{{ .Values.environment }}-rabbitmq"
               to: "rabbitmq/{{ .Values.environment }}-rabbitmq"
-            - from: "{{ .Release.Namespace }}/staging-archmeister-rw"
+            - from: "{{ .Release.Namespace }}/{{ $name  }}-archmaester-rw"
-              to: "atlantis/staging-archmeister-rw"
+              to: "atlantis/{{ $name }}-archmaester-rw"
             - from: "idp/{{ .Values.environment }}-openfga"
               to: "idp/{{ .Values.environment }}-openfga"
             - from: "otel/opentelemetry-collector"
@@ -99,21 +97,11 @@ spec:
               config: |-
                 version: v1beta1
                 import:
-                - kind: Cluster
-                  apiVersion: postgresql.cnpg.io/v1
                 - kind: Secret
                   apiVersion: v1
-                # - kind: Component
-                #   apiVersion: dapr.io/v1alpha1
-                # - kind: Configuration
-                #   apiVersion: dapr.io/v1alpha1
-                # - kind: Subscription
-                #   apiVersion: dapr.io/v1alpha1
-                # - kind: CiliumNetworkPolicy
-                #   apiVersion: cilium.io/v2
                 export:
-                - kind: CiliumNetworkPolicy
+                - kind: Cluster
-                  apiVersion: cilium.io/v2
+                  apiVersion: postgresql.cnpg.io/v1
           init:
             manifests: |-
               ---