ci(staging): deploy sorcerer 5db33158-debug

Bump prod atlantis v1.42.24 -> v1.42.25
Bump prod sorcerer v1.42.24 -> v1.42.25
2026-06-05 09:01:13 +00:00 · 2026-06-05 01:48:22 +02:00 · 2026-06-05 01:47:16 +02:00 · 2026-06-05 01:33:40 +02:00 · 2026-06-04 23:22:44 +00:00 · 2026-06-04 23:22:06 +00:00
786 changed files with 8063 additions and 61370 deletions
@@ -1,12 +1,16 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
-watch_file nix/sources.json
+watch_file npins/sources.json
 # Load .env file if it exists
 dotenv_if_exists
 # Set npins dir
 export NPINS_DIRECTORY="nix"
 # Activate development shell
-use nix
+if type lorri &>/dev/null; then
    echo "direnv: using lorri from PATH ($(type -p lorri))"
    eval "$(lorri direnv)"
 else
    # fall back to using direnv's builtin nix support
    # to prevent bootstrapping problems.
    use nix
 fi
@@ -1,6 +1,7 @@
 *.tgz
 _*/
 .direnv/
 .env
 .pre-commit-config.yaml
 _*.yaml
 backup/
@@ -1,46 +0,0 @@
 image:
  name: alpine/helm:latest
  entrypoint: [ "/bin/bash", "-c" ]
 stages:
  - release
 release:
  stage: release
  rules:
  - if: '$CI_COMMIT_BRANCH =~ /^main/'
    when: always
  - when: never
  script:
    - |
      cd $CI_PROJECT_DIR
      for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
        if [ ! -z $pack ]; then
          chart=$(basename $pack)
          curl --request POST \
               --user gitlab-ci-token:$CI_JOB_TOKEN \
               --form "chart=@${chart}" \
               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
        fi
      done
 rebuild:
  stage: release
  rules:
    - when: manual
      allow_failure: true
  script:
    - |
      cd $CI_PROJECT_DIR
      for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
        if [ ! -z $pack ]; then
          chart=$(basename $pack)
          curl --request POST \
               --user gitlab-ci-token:$CI_JOB_TOKEN \
               --form "chart=@${chart}" \
               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
        fi
      done
@@ -1,27 +0,0 @@
 apiVersion: v2
 name: sys
 description: A Helm chart for Kubernetes
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives
 # to be deployed.
 #
 # Library charts provide useful utilities or functions for the chart developer. They're included as
 # a dependency of application charts to inject those utilities and functions into the rendering
 # pipeline. Library charts do not define any templates and therefore cannot be deployed.
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 version: 0.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
 appVersion: "1.16.0"
 dependencies: # A list of the chart requirements (optional)
  - name: sys-cilium-policies
    condition: cilium.enabled
@@ -1,23 +0,0 @@
 # Patterns to ignore when building packages.
 # This supports shell glob matching, relative path matching, and
 # negation (prefixed with !). Only one pattern per line.
 .DS_Store
 # Common VCS dirs
 .git/
 .gitignore
 .bzr/
 .bzrignore
 .hg/
 .hgignore
 .svn/
 # Common backup files
 *.swp
 *.bak
 *.tmp
 *.orig
 *~
 # Various IDEs
 .project
 .idea/
 *.tmproj
 .vscode/
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-applicationset-ingress
  namespace: argocd
 spec:
  description: Allow access from the ingress controller
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: applicationset-controller
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-argo-notifications
  namespace: argocd
 spec:
  description: Allow access to the ArgoCD Notifications
  egress:
    - toFQDNs:
        - matchName: slack.com
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: notifications-controller
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-argo-repo-access-applicationset
  namespace: argocd
 spec:
  description: Allow access to the ArgoCD repo Applicationset
  egress:
    - toEntities:
        - world
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: applicationset-controller
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-argo-repo-access
  namespace: argocd
 spec:
  description: Allow access to the ArgoCD repo server
  egress:
    - toEntities:
        - world
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: repo-server
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-chartmuseum-ingress
  namespace: argocd
 spec:
  description: Allow access to the chartmuseum ingress
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: chartmuseum
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-image-updater-repo-access
  namespace: argocd
 spec:
  description: Allow argoCD image updater to access github container registry
  egress:
    - toFQDNs:
        - matchName: ghcr.io
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-image-updater
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-ingress
  namespace: argocd
 spec:
  description: Allow access from the ingress controller
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: server
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: argocd
 spec:
  description: Allow access to the Kube API server
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-microsoft-sso
  namespace: argocd
 spec:
  description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
  egress:
    - toFQDNs:
        - matchName: login.microsoftonline.com
        - matchPattern: '*.microsoftonline.com'
        - matchName: github.com
        - matchName: api.github.com
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-dex-server
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics-rollout
  namespace: argocd
 spec:
  description: Allow access to the Prometheus metrics
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: argo-rollouts
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "8090"
              protocol: TCP
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics-workflows
  namespace: argocd
 spec:
  description: Allow access to the Prometheus metrics
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: argo-workflows
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "9090"
              protocol: TCP
@@ -1,30 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: argocd
 spec:
  description: Allow access to the Prometheus metrics
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: argocd
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "8082"
              protocol: TCP
            - port: "8080"
              protocol: TCP
            - port: "9001"
              protocol: TCP
            - port: "9121"
              protocol: TCP
            - port: "8084"
              protocol: TCP
            - port: "8083"
              protocol: TCP
            - port: "5558"
              protocol: TCP
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server-to-cert-manager
  namespace: cert-manager
 spec:
  description: Allow the API server to communicate with the cert-manager pods
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: cert-manager
  ingress:
    - fromEntities:
        - remote-node
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: cert-manager
 spec:
  description: Allow the Kube API server to communicate with cert-manager
  egress:
    - toEntities:
        - kube-apiserver
  endpointSelector:
    matchLabels: {}
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: cert-manager
 spec:
  description: Allow Prometheus metrics
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: cert-manager
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "9402"
              protocol: TCP
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-world-traffic
  namespace: cert-manager
 spec:
  description: Allow the world to communicate with cert-manager
  egress:
    - toEntities:
        - world
  endpointSelector:
    matchLabels: {}
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: cilium-spire
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-server
  namespace: cilium-spire
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - remote-node
      toPorts:
        - ports:
            - port: "8081"
              protocol: TCP
@@ -1,22 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: cilium-test
 spec:
  egress:
    - toEndpoints:
        - {}
    - toEntities:
        - cluster
    - toEntities:
        - remote-node
    - toEntities:
        - world
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - cluster
    - fromEntities:
        - world
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-acme-solvers
 spec:
  description: Policy for ingress for Acme Solvers.
  endpointSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,24 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-dns
 spec:
  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
  egress:
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
        - rules:
            dns:
              - matchPattern: '*'
  endpointSelector:
    matchExpressions:
      - key: io.kubernetes.pod.namespace
        operator: NotIn
        values:
          - kube-system
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-mariadb-operator
 spec:
  description: allow mariadb instances to be reached by operator
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: mariadb
  ingress:
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: mariadb-operator
            io.kubernetes.pod.namespace: mariadb-operator
      toPorts:
        - ports:
            - port: "3306"
              protocol: TCP
@@ -1,20 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-s3-traffic
 spec:
  description: Policy for egress for CNPG Backups.
  egress:
    - toFQDNs:
      {{- range .Values.s3.hosts }}
        - matchName: {{ . | quote }}
      {{- end }}
      {{- range .Values.s3.patterns }}
        - matchPattern: {{ . | quote }}
      {{- end }}
    - toCIDR:
      {{- range .Values.s3.cidr }}
        - {{ . | quote }}
      {{- end }}
  endpointSelector:
    matchLabels: {}
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: cilium-health-checks
 spec:
  description: Health checks
  egress:
    - toEntities:
        - remote-node
  endpointSelector:
    matchLabels:
      reserved:health: ""
  ingress:
    - fromEntities:
        - remote-node
@@ -1,9 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: deny-all
 spec:
  description: Deny all
  egress: []
  endpointSelector: {}
  ingress: []
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: cnpg
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: postgres-operator
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-webhooks
  namespace: cnpg
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "9443"
              protocol: TCP
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: kube-downscaler
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      application: downscaler-py-kube-downscaler
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-webhooks
  namespace: kube-downscaler
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "9443"
              protocol: TCP
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-host-traffic
  namespace: ingress-nginx
 spec:
  egress:
    - toEntities:
        - kube-apiserver
        - host
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-hubble-traffic
  namespace: ingress-nginx
 spec:
  egress:
    - toFQDNs:
        - matchPattern: hubble.*.*.*
        - matchPattern: hubble.*.*.*.*
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
@@ -1,17 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: ingress-nginx
 spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: ingress-nginx
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "9913"
              protocol: TCP
@@ -1,19 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-s3-traffic
  namespace: ingress-nginx
 spec:
  egress:
    - toCIDR:
        - 10.139.2.10/32
    - toCIDR:
        - 10.139.2.11/32
    - toCIDR:
        - 10.139.2.20/32
    - toCIDR:
        - 10.139.2.21/32
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: jaeger
 spec:
  egress:
    - toEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-jaeger
  namespace: jaeger
 spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: jaeger-operator
  ingress:
    - fromEntities:
        - remote-node
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: kafka
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: kafka-operator
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-webhooks
  namespace: kafka
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "9443"
              protocol: TCP
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-controller-metrics
  namespace: kube-system
 spec:
  description: Allow Controller Metrics
  endpointSelector:
    matchLabels:
      k8s-app: kube-controller-manager
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "10257"
              protocol: TCP
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-csi-webhook
  namespace: kube-system
 spec:
  endpointSelector:
    matchLabels:
      app: csi-snapshot-webhook
  ingress:
    - fromEntities:
        - remote-node
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-dns-metrics
  namespace: kube-system
 spec:
  description: Allow DNS metrics
  endpointSelector:
    matchLabels:
      k8s-app: kube-dns
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "9153"
              protocol: TCP
@@ -1,31 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-dns-world
  namespace: kube-system
 spec:
  description: Allow DNS World
  egress:
    - toCIDR:
        - 8.8.8.8/32
        - 172.31.254.11/32
        - 1.1.1.1/32
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
          rules:
            dns:
              - matchPattern: '*'
    - toEntities:
        - world
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
          rules:
            dns:
              - matchPattern: '*'
  endpointSelector:
    matchLabels:
      k8s-app: kube-dns
@@ -1,19 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-dns
  namespace: kube-system
 spec:
  description: Allow DNS
  endpointSelector:
    matchLabels:
      k8s-app: kube-dns
  ingress:
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
              operator: Exists
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-host-traffic
  namespace: kube-system
 spec:
  description: Allow Host Traffic
  egress:
    - toEntities:
        - remote-node
        - host
        - kube-apiserver
  endpointSelector:
    matchLabels: {}
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-hubble-ingress
  namespace: kube-system
 spec:
  description: Allow Hubble ingress
  endpointSelector:
    matchLabels:
      k8s-app: hubble-ui
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-hubble-oauth2-ingress
  namespace: kube-system
 spec:
  description: Allow Hubble OAuth2 ingress
  endpointSelector:
    matchLabels:
      k8s-app: oauth2-proxy
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-hubble-relay-metrics
  namespace: kube-system
 spec:
  description: Allow Hubble Relay Metrics
  endpointSelector:
    matchLabels:
      k8s-app: hubble-relay
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "9966"
              protocol: TCP
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-microsoft-sso
  namespace: kube-system
 spec:
  description: Allow Microsoft SSO
  egress:
    - toFQDNs:
        - matchName: login.microsoftonline.com
        - matchPattern: '*.microsoftonline.com'
        - matchName: graph.microsoft.com
  endpointSelector:
    matchLabels:
      k8s-app: oauth2-proxy
@@ -1,26 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-namespace-traffic
  namespace: kube-system
 spec:
  description: Allow Namespace Traffic
  egress:
    - toEndpoints:
        - {}
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
          rules:
            dns:
              - matchPattern: '*'
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEndpoints:
        - {}
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-proxy-metrics
  namespace: kube-system
 spec:
  description: Allow Proxy metrics
  endpointSelector:
    matchLabels:
      k8s-app: kube-proxy
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
    - toPorts:
        - ports:
            - port: "10249"
              protocol: TCP
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: kubelet-serving-cert-approver
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: kyverno
 spec:
  egress:
    - toEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-kyverno
  namespace: kyverno
 spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: kyverno
  ingress:
    - fromEntities:
        - remote-node
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-loki-backend-to-api-server
  namespace: loki
 spec:
  description: Promtail needs to reach kube-apiserver
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/component: backend
      app.kubernetes.io/instance: loki
@@ -1,20 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: loki
 spec:
  description: Allow Prometheus read and write
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: loki
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "3100"
              protocol: TCP
            - port: "3500"
              protocol: TCP
@@ -1,17 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-promtail-to-api-server
  namespace: loki
 spec:
  description: Promtail needs to reach kube-apiserver
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: promtail
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-stats-grafana
  namespace: loki
 spec:
  description: Allow stats
  egress:
    - toFQDNs:
        - matchName: stats.grafana.org
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: loki
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: mariadb-operator
 spec:
  egress:
    - toEntities:
        - kube-apiserver
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: mariadb-operator
@@ -1,12 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-host-to-mariadb
  namespace: mariadb-operator
 spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: mariadb-operator
  ingress:
    - fromEntities:
        - host
@@ -1,17 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: mariadb-operator
 spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: mariadb-operator
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-webhooks
  namespace: mariadb-operator
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - kube-apiserver
        - remote-node
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP
            - port: "9443"
              protocol: TCP
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-host-traffic
  namespace: mayastor
 spec:
  description: Allow Host Traffic
  egress:
    - toEntities:
        - remote-node
        - host
        - kube-apiserver
  endpointSelector:
    matchLabels: {}
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-agent-core
  namespace: mayastor
 spec:
  description: Allow Remote to Agent Core
  endpointSelector:
    matchLabels:
      app: agent-core
  ingress:
    - fromEntities:
        - remote-node
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-etcd
  namespace: mayastor
 spec:
  description: Allow Remote to Etcd
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: etcd
  ingress:
    - fromEntities:
        - remote-node
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-to-maya
  namespace: mayastor
 spec:
  description: Allow Remote to Mayastor
  endpointSelector:
    matchLabels:
      app: api-rest
  ingress:
    - fromEntities:
        - remote-node
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-kube-api
 spec:
  description: Allow access to the Kube API server
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app: minio
@@ -1,17 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-minio-operator
 spec:
  description: Allow access to the Kube API server
  endpointSelector:
    matchLabels:
      app: minio
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: minio-operator
      toPorts:
        - ports:
            - port: "9000"
              protocol: TCP
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
  name: allow-nodeport-ingress
 spec:
  description: Allow access to the Kube API server
  endpointSelector:
    matchLabels:
      app: minio
  ingress:
    - fromEntities:
        - world
      toPorts:
        - ports:
            - port: "9000"
              protocol: TCP
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: minio-operator
 spec:
  description: Allow access to the Kube API server
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: odigos-system
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-port-4317
  namespace: odigos-system
 spec:
  egress:
    - toPorts:
        - ports:
            - port: "4317"
              protocol: TCP
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - remote-node
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-api-server
  namespace: one-password
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: one-password-operator
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-remote-node-webhooks
  namespace: one-password
 spec:
  endpointSelector:
    matchLabels: {}
  ingress:
    - fromEntities:
        - kube-apiserver
    - toPorts:
        - ports:
            - port: "9443"
              protocol: TCP
@@ -1,16 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-kube-api
  namespace: opencost
 spec:
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: opencost
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-otel-collector-loadbalancer-ingress
  namespace: otel
 spec:
  description: Allow ingress from world
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: opentelemetry-collector
  ingress:
    - fromEntities:
        - world
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-mail-egress
  namespace: postfix
 spec:
  description: Allow mailserver to send mails to world
  egress:
    - toEntities:
        - world
  endpointSelector:
    matchLabels:
      app: smtp-relay
@@ -1,21 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-mail-ingress
  namespace: postfix
 spec:
  description: Allow all services in cluster to send mail
  endpointSelector:
    matchLabels:
      app: smtp-relay
  ingress:
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
              operator: Exists
      toPorts:
        - ports:
            - port: "25"
              protocol: TCP
            - port: "587"
              protocol: TCP
@@ -1,18 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-prometheus-metrics
  namespace: postfix
 spec:
  description: 'Allow prometheus metrics '
  endpointSelector:
    matchLabels:
      app: smtp-relay
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: prometheus
      toPorts:
        - ports:
            - port: "9154"
              protocol: TCP
@@ -1,13 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-alerting
  namespace: prometheus
 spec:
  description: Allow alerting
  egress:
    - toEntities:
        - world
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: prom-alertmanager
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-alertmanager-ingress
  namespace: prometheus
 spec:
  description: Allow Nginx ingress
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: alertmanager
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-dns-metrics
  namespace: prometheus
 spec:
  description: Allow DNS metrics
  egress:
    - toPorts:
        - ports:
            - port: "9153"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: prometheus
@@ -1,15 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-etcd-metrics
  namespace: prometheus
 spec:
  description: Allow ETCD metrics
  egress:
    - toPorts:
        - ports:
            - port: "2379"
              protocol: TCP
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: prometheus
@@ -1,14 +0,0 @@
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: allow-grafana-ingress
  namespace: prometheus
 spec:
  description: Allow Grafana ingress
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: grafana
  ingress:
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: ingress-nginx
--- a/Show More
+++ b/Show More