Merge remote-tracking branch 'origin/main' into nixidy

policies/oceanbox/kyverno/sync-atlantis-secrets.yaml

@@ -25,6 +25,11 @@ spec:
          - "*-rabbitmq"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-redis-secret
     generate:
       apiVersion: v1
@@ -44,6 +49,11 @@ spec:
          - "*-redis"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-secret
     generate:
       apiVersion: v1
@@ -63,6 +73,11 @@ spec:
          - "*-db-superuser"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-replication-secret
     generate:
       apiVersion: v1
@@ -82,6 +97,11 @@ spec:
          - prod-archmeister-replication
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-ca
     generate:
       apiVersion: v1
@@ -101,11 +121,8 @@ spec:
          - prod-archmeister-ca
          annotations:
            kyverno/clone: "true"
-    # exclude:
-    #  any:
-    #  - resources:
-    #      kinds:
-    #      - Secret
-    #      selector:
-    #        matchLabels:
-    #          generate.kyverno.io/clone-source: ""
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport

policies/oceanbox/kyverno/sync-keyvault-secret.yaml

@@ -0,0 +1,32 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Sample
+    policies.kyverno.io/description: 'Access dataprotection keys from Azure Key Vault'
+  creationTimestamp: "2024-01-15T11:58:24Z"
+  name: sync-keyvault-secrets
+spec:
+  admission: true
+  background: true
+  generateExisting: true
+  rules:
+  - generate:
+      apiVersion: v1
+      clone:
+        name: azure-keyvault
+        namespace: atlantis
+      kind: Secret
+      name: azure-keyvault
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+    match:
+      any:
+      - resources:
+          kinds:
+          - Namespace
+          names:
+          - "*-atlantis"
+    name: sync-keyvault-secrets
+
+

policies/oceanbox/kyverno/sync-regcred.yaml

@@ -10,7 +10,7 @@ metadata:
       they are created. It will also push updates to the copied Secrets should the
       source Secret be changed.            '
   creationTimestamp: "2024-01-15T11:58:24Z"
-  name: sync-oceanbox-regcred
+  name: sync-regcred
 spec:
   admission: true
   background: true
@@ -30,10 +30,8 @@ spec:
     exclude:
       any:
       - resources:
-          kinds:
-          - Namespace
-          names:
-          - "vcluster-*"
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
     match:
       any:
       - resources:

policies/oceanbox/network/atlantis/atlantis-policies.yaml

@@ -1,5 +1,5 @@
 apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
+kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: allow-atlantis-services
   namespace: {{ .Release.Namespace }}
@@ -15,12 +15,12 @@ spec:
     - matchLabels:
         k8s:io.kubernetes.pod.namespace: {{ .Values.tracing.namespace | default "otel" }}
   - toFQDNs:
-    - matchName: '*.oceanbox.io'
-    - matchName: api.github.com
     - matchName: dapr.github.io
-    - matchName: gitlab.com
-    - matchPattern: '*.gitlab.com'
-    - matchPattern: "*.k1.itpartner.no"
     - matchName: analytics.loft.rocks
+    # - matchName: gitlab.com
+    # - matchName: api.github.com
+    - matchPattern: "*.k1.itpartner.no"
+    - matchPattern: '*.oceanbox.io'
+    # - matchPattern: '*.gitlab.com'
   endpointSelector:
     matchLabels: {}

policies/oceanbox/network/clusterpolicy-allow-oceanboxio.yaml

@@ -7,7 +7,6 @@ spec:
   egress:
   - toFQDNs:
     - matchName: oceanbox.io
-    - matchName: hubble.srv.oceanbox.io
     - matchPattern: "*oceanbox.io"
     - matchPattern: "*.oceanbox.io"
 

policies/oceanbox/network/csi-addons-controller/allow-9070-host.yaml

@@ -14,3 +14,15 @@ spec:
     - ports:
       - port: "9070"
         protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: addons-to-remote-node
+  namespace: csi-addons-system
+spec:
+  description: remote node
+  egress:
+    - toEntities:
+        - remote-node
+  endpointSelector: {}

policies/oceanbox/network/templ.nix

@@ -3,8 +3,9 @@
   applications.xxx = {
     resources = {
       ciliumClusterwideNetworkPolicies = {
-        xxx.spec = {
-        };
+        xxx.spec =
+          {
+          };
       };
     };
   };