feat: add hel1 cluster

values/system/hel1/network/allow-azure-egress.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-azure-egress
+spec:
+  egress:
+  - toFQDNs:
+    - matchName: atlantis.blob.core.windows.net
+    - matchName: atlantisvault.vault.azure.net
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+  endpointSelector: {}
+
+{{- end }}

values/system/hel1/network/allow-ceph-egress.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ceph-egress
+spec:
+  egress:
+  - toCIDR:
+    - 10.255.241.30/32
+    - 10.255.241.31/32
+    - 10.255.241.32/32
+    - 10.255.244.0/24
+    # toPorts:
+    # - ports:
+    #   - port: "4443"
+    #     protocol: TCP
+  endpointSelector: {}
+
+{{- end }}

values/system/hel1/network/allow-microsoft-oidc-login.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-microsoft-oidc-login
+spec:
+  endpointSelector: {}
+  egress:
+  - toFQDNs:
+    - matchName: login.microsoftonline.com
+    - matchPattern: '*.microsoftonline.com'
+{{- end }}

values/system/hel1/network/clusterpolicy-allow-api-server.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-kube-apiserver
+spec:
+  endpointSelector:
+    matchLabels: {}
+  egress:
+  - toEntities:
+    - kube-apiserver
+{{- end }}

values/system/hel1/network/clusterpolicy-allow-ekman-egress.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ekman-egress
+spec:
+  endpointSelector: {}
+  egress:
+  - toCIDR:
+    - 10.255.241.99/32
+    - 10.255.241.100/32
+    - 185.125.160.88/32
+    - 185.125.160.89/32
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+      - port: "4443"
+        protocol: TCP
+      - port: "30443"
+        protocol: TCP
+      - port: "30080"
+        protocol: TCP
+{{- end }}

values/system/hel1/network/clusterpolicy-allow-namespace-traffic.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-namespace-traffic
+spec:
+  description: "Allow all traffic within a namespace, allow dns, allow egress to all entities in cluster"
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+  egress:
+    - toEndpoints:
+      - matchExpressions:
+        - key: io.kubernetes.pod.namespace
+          operator: Exists
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: "*"
+{{- end }}

values/system/hel1/network/clusterpolicy-allow-oceanboxio.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-oceanboxio-egress
+spec:
+  endpointSelector: {}
+  egress:
+  - toFQDNs:
+    - matchName: oceanbox.io
+    - matchPattern: "*oceanbox.io"
+    - matchPattern: "*.oceanbox.io"
+
+{{- end }}

values/system/hel1/network/clusterpolicy-allow-remote-node.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+  - fromEntities:
+    - kube-apiserver
+{{- end }}