refactor: move resorces and policies to system

values/system/oceanbox/network/allow-azure-egress.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-azure-egress
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: atlantis.blob.core.windows.net
+    - matchName: atlantisvault.vault.azure.net
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+  endpointSelector: {}
+

values/system/oceanbox/network/allow-ceph-egress.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ceph-egress
+spec:
+  egress:
+  - toCIDR:
+    - 10.255.241.30/32
+    - 10.255.241.31/32
+    - 10.255.241.32/32
+    - 10.255.244.0/24
+    # toPorts:
+    # - ports:
+    #   - port: "4443"
+    #     protocol: TCP
+  endpointSelector: {}
+

values/system/oceanbox/network/allow-microsoft-oidc-login.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-microsoft-oidc-login
+spec:
+  endpointSelector: {}
+  egress:
+  - toFQDNs:
+    - matchName: login.microsoftonline.com
+    - matchPattern: '*.microsoftonline.com'

values/system/oceanbox/network/atlantis/allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: atlantis
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

values/system/oceanbox/network/atlantis/atlantis-policies.yaml

@@ -0,0 +1,26 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-atlantis-services
+  namespace: {{ .Release.Namespace }}
+spec:
+  egress:
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: dapr-system
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: {{ .Values.rabbitmq.namespace | default "rabbitmq" }}
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: {{ .Values.tracing.namespace | default "otel" }}
+  - toFQDNs:
+    - matchName: dapr.github.io
+    - matchName: analytics.loft.rocks
+    # - matchName: gitlab.com
+    # - matchName: api.github.com
+    - matchPattern: "*.k1.itpartner.no"
+    - matchPattern: '*.oceanbox.io'
+    # - matchPattern: '*.gitlab.com'
+  endpointSelector:
+    matchLabels: {}

values/system/oceanbox/network/clusterpolicy-allow-api-server.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-kube-apiserver
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver

values/system/oceanbox/network/clusterpolicy-allow-ekman-egress.yaml

@@ -0,0 +1,22 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ekman-egress
+spec:
+  endpointSelector: {}
+  egress:
+  - toCIDR:
+    - 10.255.241.99/32
+    - 10.255.241.100/32
+    - 185.125.160.88/32
+    - 185.125.160.89/32
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+      - port: "4443"
+        protocol: TCP
+      - port: "30443"
+        protocol: TCP
+      - port: "30080"
+        protocol: TCP

values/system/oceanbox/network/clusterpolicy-allow-namespace-traffic.yaml

@@ -0,0 +1,28 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-namespace-traffic
+spec:
+  description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+  egress:
+    - toEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: "*"

values/system/oceanbox/network/clusterpolicy-allow-oceanboxio.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-oceanboxio-egress
+spec:
+  endpointSelector: {}
+  egress:
+  - toFQDNs:
+    - matchName: oceanbox.io
+    - matchPattern: "*oceanbox.io"
+    - matchPattern: "*.oceanbox.io"
+

values/system/oceanbox/network/clusterpolicy-allow-remote-node.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+  - fromEntities:
+    - kube-apiserver

values/system/oceanbox/network/csi-addons-controller/allow-9070-host.yaml

@@ -0,0 +1,28 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-port-9070
+  namespace: csi-addons-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: csi-addons
+  egress:
+  - toEntities:
+    - host
+    toPorts:
+    - ports:
+      - port: "9070"
+        protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: addons-to-remote-node
+  namespace: csi-addons-system
+spec:
+  description: remote node
+  egress:
+    - toEntities:
+        - remote-node
+  endpointSelector: {}

values/system/oceanbox/network/dapr/allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: dapr-system
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

values/system/oceanbox/network/dapr/allow-remote-node.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: dapr-system
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+  - fromEntities:
+    - kube-apiserver
+    - remote-node
+  - toPorts:
+    - ports:
+      - port: "4000"
+        protocol: TCP

values/system/oceanbox/network/geoserver/allow-geoserver-ingress.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-geoserver-ingress
+  namespace: geoserver
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: geoserver
+  ingress:
+    - fromEndpoints:
+      - matchLabels:
+          io.kubernetes.pod.namespace: ingress-nginx

values/system/oceanbox/network/idp/allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: idp
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

values/system/oceanbox/network/idp/allow-gitlab.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-grafana-oidc-login
+  namespace: idp
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: cerbos
+  egress:
+  - toFQDNs:
+    - matchName: gitlab.com
+    - matchPattern: '*.gitlab.com'

values/system/oceanbox/network/idp/allow-idp-external-access.yaml

@@ -0,0 +1,13 @@
+piVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-external-idp
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: login.microsoftonline.com
+    - matchName: graph.microsoft.com
+    - matchName: s3.k1.itpartner.no
+    - matchName: telemetry.cerbos.dev
+  endpointSelector: {}
+

values/system/oceanbox/network/idp/allow-itp-smtpgw.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-itp-smtp
+  namespace: idp
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: keycloak
+  egress:
+  - toFQDNs:
+    - matchName: smtpgw.itpartner.no

values/system/oceanbox/network/idp/allow-keycloak.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-keycloak
+  namespace: idp
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: dex
+  egress:
+  - toFQDNs:
+    - matchName: auth.srv.oceanbox.io

values/system/oceanbox/network/jaeger/allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: jaeger
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

values/system/oceanbox/network/jaeger/allow-remote-node.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: jaeger
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+  - fromEntities:
+    - kube-apiserver
+  - toPorts:
+    - ports:
+      - port: "9443"
+        protocol: TCP
+      - port: "443"
+        protocol: TCP

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-loki-backend-to-api-server.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-loki-backend-to-api-server
+  namespace: loki
+spec:
+  description: Promtail needs to reach kube-apiserver
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: backend
+      app.kubernetes.io/instance: loki

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: loki
+spec:
+  description: Allow Prometheus read and write
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: loki
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+            - port: "3500"
+              protocol: TCP

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-promtail-to-api-server.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-promtail-to-api-server
+  namespace: loki
+spec:
+  description: Promtail needs to reach kube-apiserver
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: promtail

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-s3-traffic.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-s3-traffic
+  namespace: loki
+spec:
+  egress:
+    - toCIDR:
+        - 10.139.2.20/32
+        - 10.255.241.30/32
+  endpointSelector:
+    matchLabels: {}

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-s3.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-s3
+  namespace: loki
+spec:
+  description: Allow loki to ship logs to s3
+  egress:
+    - toFQDNs:
+        - matchPattern: s3.*.oceanbox.io
+        - matchPattern: s3.*.itpartner.no
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: loki

values/system/oceanbox/network/loki/CiliumNetworkPolicy-allow-stats-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-stats-grafana
+  namespace: loki
+spec:
+  description: Allow stats
+  egress:
+    - toFQDNs:
+        - matchName: stats.grafana.org
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: loki

values/system/oceanbox/network/rabbitmq/policy-allow-rabbitmq.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-to-rabbitmq-http
+  namespace: rabbitmq
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: rabbitmq
+  ingress:
+  - fromEntities:
+    - world
+  - toPorts:
+    - ports:
+      - port: "15672"
+        protocol: TCP
+