Merge remote-tracking branch 'origin/main' into nixidy

policies/oceanbox/network/atlantis/atlantis-policies.yaml

@@ -1,5 +1,5 @@
 apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
+kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: allow-atlantis-services
   namespace: {{ .Release.Namespace }}
@@ -15,12 +15,12 @@ spec:
     - matchLabels:
         k8s:io.kubernetes.pod.namespace: {{ .Values.tracing.namespace | default "otel" }}
   - toFQDNs:
-    - matchName: '*.oceanbox.io'
-    - matchName: api.github.com
     - matchName: dapr.github.io
-    - matchName: gitlab.com
-    - matchPattern: '*.gitlab.com'
-    - matchPattern: "*.k1.itpartner.no"
     - matchName: analytics.loft.rocks
+    # - matchName: gitlab.com
+    # - matchName: api.github.com
+    - matchPattern: "*.k1.itpartner.no"
+    - matchPattern: '*.oceanbox.io'
+    # - matchPattern: '*.gitlab.com'
   endpointSelector:
     matchLabels: {}

policies/oceanbox/network/clusterpolicy-allow-oceanboxio.yaml

@@ -7,7 +7,6 @@ spec:
   egress:
   - toFQDNs:
     - matchName: oceanbox.io
-    - matchName: hubble.srv.oceanbox.io
     - matchPattern: "*oceanbox.io"
     - matchPattern: "*.oceanbox.io"
 

policies/oceanbox/network/csi-addons-controller/allow-9070-host.yaml

@@ -14,3 +14,15 @@ spec:
     - ports:
       - port: "9070"
         protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: addons-to-remote-node
+  namespace: csi-addons-system
+spec:
+  description: remote node
+  egress:
+    - toEntities:
+        - remote-node
+  endpointSelector: {}

policies/oceanbox/network/templ.nix

@@ -3,8 +3,9 @@
   applications.xxx = {
     resources = {
       ciliumClusterwideNetworkPolicies = {
-        xxx.spec = {
-        };
+        xxx.spec =
+          {
+          };
       };
     };
   };