devel: Remove attic

It's now available on the attic branch.
devel: Useful kubectl plugins
2026-01-20 18:50:22 +01:00 · 2026-01-20 18:17:07 +01:00 · 2026-01-20 17:16:54 +01:00 · 2026-01-20 17:03:03 +01:00 · 2026-01-20 15:45:13 +01:00 · 2026-01-20 14:42:27 +00:00
524 changed files with 3263 additions and 60312 deletions
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # the shebang is ignored, but nice for editors
 watch_file nix/sources.json
+watch_file nix/checks.nix

 # Load .env file if it exists
 dotenv_if_exists
@@ -1,6 +1,7 @@
 *.tgz
 _*/
 .direnv/
+.env
 .pre-commit-config.yaml
 _*.yaml
 backup/
@@ -1,46 +1,54 @@
-image:
-  name: alpine/helm:latest
-  entrypoint: [ "/bin/bash", "-c" ]
+# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
+default:
+  tags:
+    - nix

-stages:
-  - release
+include:
+  - project: oceanbox/gitlab-ci
+    ref: v4.5
+    file: template/Base.gitlab-ci.yml
+# stages:
+# - release

-release:
-  stage: release
-  rules:
-  - if: '$CI_COMMIT_BRANCH =~ /^main/'
-    when: always
-  - when: never
-  script:
-    - |
-      cd $CI_PROJECT_DIR
-      for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-        if [ ! -z $pack ]; then
-          chart=$(basename $pack)
-          curl --request POST \
-               --user gitlab-ci-token:$CI_JOB_TOKEN \
-               --form "chart=@${chart}" \
-               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-        fi
-      done
+# image:
+# name: alpine/helm:latest
+# entrypoint: ["/bin/bash", "-c"]

-rebuild:
-  stage: release
-  rules:
-    - when: manual
-      allow_failure: true
-  script:
-    - |
-      cd $CI_PROJECT_DIR
-      for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
-        pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-        if [ ! -z $pack ]; then
-          chart=$(basename $pack)
-          curl --request POST \
-               --user gitlab-ci-token:$CI_JOB_TOKEN \
-               --form "chart=@${chart}" \
-               "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-        fi
-      done
+# release:
+# stage: release
+# rules:
+# - if: "$CI_COMMIT_BRANCH =~ /^main/"
+# when: always
+# - when: never
+# script:
+# - |
+# cd $CI_PROJECT_DIR
+# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# if [ ! -z $pack ]; then
+# chart=$(basename $pack)
+# curl --request POST \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
+# --form "chart=@${chart}" \
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# fi
+# done

+# rebuild:
+# stage: release
+# rules:
+# - when: manual
+# allow_failure: true
+# script:
+# - |
+# cd $CI_PROJECT_DIR
+# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
+# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
+# if [ ! -z $pack ]; then
+# chart=$(basename $pack)
+# curl --request POST \
+# --user gitlab-ci-token:$CI_JOB_TOKEN \
+# --form "chart=@${chart}" \
+# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
+# fi
+# done
@@ -1,26 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
-*.nix
-old/
-nix/
@@ -1,27 +0,0 @@
-apiVersion: v2
-name: sys
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"
-dependencies: # A list of the chart requirements (optional)
-  - name: sys-cilium-policies
-    condition: cilium.enabled
@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
@@ -1,24 +0,0 @@
-apiVersion: v2
-name: cilium
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-applicationset-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-notifications
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD Notifications
-  egress:
-    - toFQDNs:
-        - matchName: slack.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: notifications-controller
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access-applicationset
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo Applicationset
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: applicationset-controller
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-argo-repo-access
-  namespace: argocd
-spec:
-  description: Allow access to the ArgoCD repo server
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: repo-server
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-chartmuseum-ingress
-  namespace: argocd
-spec:
-  description: Allow access to the chartmuseum ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: chartmuseum
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-image-updater-repo-access
-  namespace: argocd
-spec:
-  description: Allow argoCD image updater to access github container registry
-  egress:
-    - toFQDNs:
-        - matchName: ghcr.io
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-image-updater
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-ingress
-  namespace: argocd
-spec:
-  description: Allow access from the ingress controller
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: server
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: argocd
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-microsoft-sso
-  namespace: argocd
-spec:
-  description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: github.com
-        - matchName: api.github.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-dex-server
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-rollout
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-rollouts
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8090"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics-workflows
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argo-workflows
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "9090"
-              protocol: TCP
@@ -1,30 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: argocd
-spec:
-  description: Allow access to the Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: argocd
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8082"
-              protocol: TCP
-            - port: "8080"
-              protocol: TCP
-            - port: "9001"
-              protocol: TCP
-            - port: "9121"
-              protocol: TCP
-            - port: "8084"
-              protocol: TCP
-            - port: "8083"
-              protocol: TCP
-            - port: "5558"
-              protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server-to-cert-manager
-  namespace: cert-manager
-spec:
-  description: Allow the API server to communicate with the cert-manager pods
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cert-manager
-spec:
-  description: Allow the Kube API server to communicate with cert-manager
-  egress:
-    - toEntities:
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: cert-manager
-spec:
-  description: Allow Prometheus metrics
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: cert-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9402"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-traffic
-  namespace: cert-manager
-spec:
-  description: Allow the world to communicate with cert-manager
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-spire
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-server
-  namespace: cilium-spire
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "8081"
-              protocol: TCP
@@ -1,22 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cilium-test
-spec:
-  egress:
-    - toEndpoints:
-        - {}
-    - toEntities:
-        - cluster
-    - toEntities:
-        - remote-node
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - cluster
-    - fromEntities:
-        - world
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-acme-solvers
-spec:
-  description: Policy for ingress for Acme Solvers.
-  endpointSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,24 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-dns
-spec:
-  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-        - rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.pod.namespace
-        operator: NotIn
-        values:
-          - kube-system
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-mariadb-operator
-spec:
-  description: allow mariadb instances to be reached by operator
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: mariadb
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: mariadb-operator
-            io.kubernetes.pod.namespace: mariadb-operator
-      toPorts:
-        - ports:
-            - port: "3306"
-              protocol: TCP
@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-spec:
-  description: Policy for egress for CNPG Backups.
-  egress:
-    - toFQDNs:
-      {{- range .Values.s3.hosts }}
-        - matchName: {{ . | quote }}
-      {{- end }}
-      {{- range .Values.s3.patterns }}
-        - matchPattern: {{ . | quote }}
-      {{- end }}
-    - toCIDR:
-      {{- range .Values.s3.cidr }}
-        - {{ . | quote }}
-      {{- end }}
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-health-checks
-spec:
-  description: Health checks
-  egress:
-    - toEntities:
-        - remote-node
-  endpointSelector:
-    matchLabels:
-      reserved:health: ""
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: deny-all
-spec:
-  description: Deny all
-  egress: []
-  endpointSelector: {}
-  ingress: []
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: cnpg
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: postgres-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: cnpg
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kube-downscaler
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      application: downscaler-py-kube-downscaler
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kube-downscaler
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9913"
-              protocol: TCP
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-s3-traffic
-  namespace: ingress-nginx
-spec:
-  egress:
-    - toCIDR:
-        - 10.139.2.10/32
-    - toCIDR:
-        - 10.139.2.11/32
-    - toCIDR:
-        - 10.139.2.20/32
-    - toCIDR:
-        - 10.139.2.21/32
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-nginx
-  namespace: ingress-nginx
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: jaeger
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-jaeger
-  namespace: jaeger
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: jaeger-operator
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kafka
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kafka-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: kafka
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-controller-metrics
-  namespace: kube-system
-spec:
-  description: Allow Controller Metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-controller-manager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "10257"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-csi-webhook
-  namespace: kube-system
-spec:
-  endpointSelector:
-    matchLabels:
-      app: csi-snapshot-webhook
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-metrics
-  namespace: kube-system
-spec:
-  description: Allow DNS metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9153"
-              protocol: TCP
@@ -1,31 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-world
-  namespace: kube-system
-spec:
-  description: Allow DNS World
-  egress:
-    - toCIDR:
-        - 8.8.8.8/32
-        - 172.31.254.11/32
-        - 1.1.1.1/32
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-    - toEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns
-  namespace: kube-system
-spec:
-  description: Allow DNS
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: kube-system
-spec:
-  description: Allow Host Traffic
-  egress:
-    - toEntities:
-        - remote-node
-        - host
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-ingress
-  namespace: kube-system
-spec:
-  description: Allow Hubble ingress
-  endpointSelector:
-    matchLabels:
-      k8s-app: hubble-ui
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-oauth2-ingress
-  namespace: kube-system
-spec:
-  description: Allow Hubble OAuth2 ingress
-  endpointSelector:
-    matchLabels:
-      k8s-app: oauth2-proxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-relay-metrics
-  namespace: kube-system
-spec:
-  description: Allow Hubble Relay Metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: hubble-relay
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "9966"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-microsoft-sso
-  namespace: kube-system
-spec:
-  description: Allow Microsoft SSO
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: graph.microsoft.com
-  endpointSelector:
-    matchLabels:
-      k8s-app: oauth2-proxy
@@ -1,26 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-namespace-traffic
-  namespace: kube-system
-spec:
-  description: Allow Namespace Traffic
-  egress:
-    - toEndpoints:
-        - {}
-    - toEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-          rules:
-            dns:
-              - matchPattern: '*'
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEndpoints:
-        - {}
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-proxy-metrics
-  namespace: kube-system
-spec:
-  description: Allow Proxy metrics
-  endpointSelector:
-    matchLabels:
-      k8s-app: kube-proxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "10249"
-              protocol: TCP
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: kubelet-serving-cert-approver
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: kyverno
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: kyverno
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kyverno
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "8000"
-              protocol: TCP
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-kyverno
-  namespace: kyverno
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: kyverno
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-loki-backend-to-api-server
-  namespace: loki
-spec:
-  description: Promtail needs to reach kube-apiserver
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/component: backend
-      app.kubernetes.io/instance: loki
@@ -1,20 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: loki
-spec:
-  description: Allow Prometheus read and write
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: loki
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "3100"
-              protocol: TCP
-            - port: "3500"
-              protocol: TCP
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-promtail-to-api-server
-  namespace: loki
-spec:
-  description: Promtail needs to reach kube-apiserver
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: promtail
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-stats-grafana
-  namespace: loki
-spec:
-  description: Allow stats
-  egress:
-    - toFQDNs:
-        - matchName: stats.grafana.org
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: loki
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: mariadb-operator
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-to-mariadb
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
-  ingress:
-    - fromEntities:
-        - host
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: mariadb-operator
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: mariadb-operator
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-        - remote-node
-      toPorts:
-        - ports:
-            - port: "443"
-              protocol: TCP
-            - port: "9443"
-              protocol: TCP
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: mayastor
-spec:
-  description: Allow Host Traffic
-  egress:
-    - toEntities:
-        - remote-node
-        - host
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-agent-core
-  namespace: mayastor
-spec:
-  description: Allow Remote to Agent Core
-  endpointSelector:
-    matchLabels:
-      app: agent-core
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-etcd
-  namespace: mayastor
-spec:
-  description: Allow Remote to Etcd
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: etcd
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-maya
-  namespace: mayastor
-spec:
-  description: Allow Remote to Mayastor
-  endpointSelector:
-    matchLabels:
-      app: api-rest
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-kube-api
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app: minio
@@ -1,17 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-minio-operator
-spec:
-  description: Allow access to the Kube API server
-  endpointSelector:
-    matchLabels:
-      app: minio
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: minio-operator
-      toPorts:
-        - ports:
-            - port: "9000"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: allow-nodeport-ingress
-spec:
-  description: Allow access to the Kube API server
-  endpointSelector:
-    matchLabels:
-      app: minio
-  ingress:
-    - fromEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: "9000"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: minio-operator
-spec:
-  description: Allow access to the Kube API server
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: odigos-system
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-port-4317
-  namespace: odigos-system
-spec:
-  egress:
-    - toPorts:
-        - ports:
-            - port: "4317"
-              protocol: TCP
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-api-server
-  namespace: one-password
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: one-password-operator
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-webhooks
-  namespace: one-password
-spec:
-  endpointSelector:
-    matchLabels: {}
-  ingress:
-    - fromEntities:
-        - kube-apiserver
-    - toPorts:
-        - ports:
-            - port: "9443"
-              protocol: TCP
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-kube-api
-  namespace: opencost
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: "6443"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: opencost
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-otel-collector-loadbalancer-ingress
-  namespace: otel
-spec:
-  description: Allow ingress from world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: opentelemetry-collector
-  ingress:
-    - fromEntities:
-        - world
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-mail-egress
-  namespace: postfix
-spec:
-  description: Allow mailserver to send mails to world
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
@@ -1,21 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-mail-ingress
-  namespace: postfix
-spec:
-  description: Allow all services in cluster to send mail
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.pod.namespace
-              operator: Exists
-      toPorts:
-        - ports:
-            - port: "25"
-              protocol: TCP
-            - port: "587"
-              protocol: TCP
@@ -1,18 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: postfix
-spec:
-  description: 'Allow prometheus metrics '
-  endpointSelector:
-    matchLabels:
-      app: smtp-relay
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-      toPorts:
-        - ports:
-            - port: "9154"
-              protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-alerting
-  namespace: prometheus
-spec:
-  description: Allow alerting
-  egress:
-    - toEntities:
-        - world
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: prom-alertmanager
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-alertmanager-ingress
-  namespace: prometheus
-spec:
-  description: Allow Nginx ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: alertmanager
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-dns-metrics
-  namespace: prometheus
-spec:
-  description: Allow DNS metrics
-  egress:
-    - toPorts:
-        - ports:
-            - port: "9153"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-etcd-metrics
-  namespace: prometheus
-spec:
-  description: Allow ETCD metrics
-  egress:
-    - toPorts:
-        - ports:
-            - port: "2379"
-              protocol: TCP
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-ingress
-  namespace: prometheus
-spec:
-  description: Allow Grafana ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,16 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-oidc-login
-  namespace: prometheus
-spec:
-  description: Allow Grafana OIDC login
-  egress:
-    - toFQDNs:
-        - matchName: login.microsoftonline.com
-        - matchPattern: '*.microsoftonline.com'
-        - matchName: api.github.com
-        - matchName: github.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
@@ -1,15 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-plugins
-  namespace: prometheus
-spec:
-  description: Allow Grafana Plugins
-  egress:
-    - toFQDNs:
-        - matchName: grafana.com
-        - matchName: storage.googleapis.com
-        - matchName: raw.githubusercontent.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-grafana-secure-gravatar
-  namespace: prometheus
-spec:
-  description: Allow Grafana Secure Gravatar
-  egress:
-    - toFQDNs:
-        - matchName: secure.grafana.com
-        - matchName: secure.gravatar.com
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: grafana
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: prometheus
-spec:
-  description: Allow Host Traffic
-  egress:
-    - toEntities:
-        - remote-node
-        - host
-        - kube-apiserver
-  endpointSelector:
-    matchLabels: {}
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-nginx-ingress
-  namespace: prometheus
-spec:
-  description: Allow Nginx ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: ingress-nginx
@@ -1,19 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-opencost-scrape
-  namespace: prometheus
-spec:
-  description: Allow OpenCost scrape
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prometheus
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            app.kubernetes.io/name: opencost
-            io.kubernetes.pod.namespace: opencost
-    - toPorts:
-        - ports:
-            - port: "9090"
-              protocol: TCP
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-metrics-server
-  namespace: prometheus
-spec:
-  description: Allow Remote Metrics Server
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: metrics-server
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-remote-node-to-webhook
-  namespace: prometheus
-spec:
-  description: Allow Remote Web Hook
-  endpointSelector:
-    matchLabels:
-      app: kube-prometheus-stack-operator
-  ingress:
-    - fromEntities:
-        - remote-node
@@ -1,14 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-robusta-ingress
-  namespace: prometheus
-spec:
-  description: Allow Robusta ingress
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: prom-prometheus
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: robusta
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
mrtz	1e8584281a	devel: Remove attic It's now available on the attic branch.	2026-01-20 18:50:22 +01:00
mrtz	75a5fb5c83	devel: Useful kubectl plugins	2026-01-20 18:17:07 +01:00
mrtz	0eb60de429	chore(ingress-nginx): Bump to latest	2026-01-20 17:16:54 +01:00
mrtz	9d034eea25	chore(ingress-nginx): Bump to latest v4.9	2026-01-20 17:03:03 +01:00
mrtz	6104114404	fix(rabbitmq): Also bump resources for prod	2026-01-20 15:45:13 +01:00
mrtz	1e7126fedb	ci: sorcerer	2026-01-20 14:42:27 +00:00
mrtz	0d12907f4c	ci: atlantis	2026-01-20 14:42:20 +00:00
mrtz	297e5efd88	fix(rabbitmq): Set proper memory requests	2026-01-20 15:38:30 +01:00
mrtz	d09eabd2bd	chore(rabbitmq): Bump to latest v13	2026-01-20 15:29:51 +01:00
mrtz	351bb41f80	chore(rabbitmq): Bump to latest v12	2026-01-20 15:15:43 +01:00
mrtz	fd773bff9f	fix(rabbitmq): Prepare for upgrades	2026-01-20 15:08:19 +01:00
simkir	196d3ed0eb	atlantis: Remove limits in staging	2026-01-20 09:04:40 +01:00
mrtz	f617f29a50	ci: atlantis	2026-01-19 19:07:24 +00:00
mrtz	0bc45748cf	fix(spegel): Typo	2026-01-19 19:27:45 +01:00
mrtz	fdbdb138e1	fix(spegel): Double the escape, double the fun	2026-01-19 19:26:55 +01:00
mrtz	b2ed367b2a	fix(spegel): Whitelist gitlab	2026-01-19 19:25:41 +01:00
stigrj	22cb7bddb6	ci: atlantis	2026-01-19 16:15:47 +00:00
simkir	fe1c3db4b2	ci: codex	2026-01-19 15:08:56 +00:00
Radovan Bast	830c44644d	ci: makai	2026-01-19 15:03:04 +00:00
simkir	5825a4bbc2	ci: atlantis	2026-01-19 14:50:46 +00:00
simkir	a7b3310a10	codex: Remove manual production tag	2026-01-19 15:49:56 +01:00
Radovan Bast	ecfa74dddd	ci: makai	2026-01-19 14:35:06 +00:00
juselius	8a931d7c03	ci: codex	2026-01-19 13:43:06 +00:00
juselius	c7b099cff2	ci: sorcerer	2026-01-19 13:43:00 +00:00
juselius	24276410c1	ci: atlantis	2026-01-19 13:42:53 +00:00
mrtz	5493008cb6	chore(spegel): Bump to 0.6.0	2026-01-18 18:19:45 +01:00
juselius	a788539d33	ci: codex	2026-01-16 19:06:46 +00:00
juselius	3e06946d04	Merge branch 'automated/npins-update-20260116' into 'main' chore: update npins dependencies See merge request oceanbox/manifests!67	2026-01-16 20:03:00 +01:00
mrtz	29a51653f3	chore: update npins dependencies Automated update of Nix dependencies via npins. Updated packages: + "hash": "sha256-wufp5c0nWh/87f9eK7xy1eZXms5zd4yl6S4SR+LfA08="	2026-01-16 15:00:16 +00:00
mrtz	23b43c9b41	chore(forgejo): Bump to 14.0	2026-01-16 07:03:19 +01:00
mrtz	53ac321316	ci: codex	2026-01-15 17:01:05 +00:00
mrtz	c5d42f2266	ci: sorcerer	2026-01-15 17:00:59 +00:00
mrtz	a8bbe28137	ci: atlantis	2026-01-15 17:00:50 +00:00
Radovan Bast	ed9dd67040	ci: makai	2026-01-15 11:22:39 +00:00
Radovan Bast	ef13e1f980	ci: makai	2026-01-15 08:23:47 +00:00
simkir	5d3f57e518	ci: codex	2026-01-15 07:36:32 +00:00
simkir	97ed914338	Enable auto-sync for codex-staging	2026-01-15 08:33:50 +01:00
mrtz	aa0ee6ad37	fix: Naming	2026-01-15 00:10:48 +01:00
mrtz	7afc34dbf8	fix(forgejo): HEll	2026-01-15 00:08:08 +01:00
mrtz	c77e11f0d2	fix(forgejo): It's getting late us -> eu	2026-01-14 23:58:02 +01:00
mrtz	78892df3fc	fix(forgejo): Location matters...	2026-01-14 23:54:52 +01:00
mrtz	c3b1cab416	fix(forgejo): Non fully-qualified	2026-01-14 23:52:35 +01:00
mrtz	7227f07b71	fix(forgejo): Remove duplicate storage type	2026-01-14 23:51:54 +01:00
mrtz	683c7f36c3	fix(forgejo): App Path	2026-01-14 23:17:10 +01:00
mrtz	98812a6a3b	fix(forgejo): Try us-east	2026-01-14 19:19:34 +01:00
mrtz	8f990cff54	fix(forgejo): Set DB type	2026-01-14 18:49:39 +01:00
mrtz	a2678efd78	fix(forgejo): Remove ssl	2026-01-14 18:47:10 +01:00
mrtz	cdbacbd34c	fix(forgejo): Remove ssl	2026-01-14 18:39:22 +01:00
mrtz	20ca29d5ec	fix(forgejo): Hetzner on :443	2026-01-14 18:35:26 +01:00
mrtz	9c42fd665d	fix(forgejo): Set storagetype	2026-01-14 18:31:15 +01:00
mrtz	7468b902ce	fix(foregjo): Change minio endpoint	2026-01-14 18:29:05 +01:00
simkir	62578486ce	ci: sorcerer	2026-01-14 15:55:48 +00:00
simkir	6b17805a42	ci: codex	2026-01-14 15:55:41 +00:00
simkir	e35b81b356	ci: atlantis	2026-01-14 15:55:33 +00:00
mrtz	10758b334b	chore(forgejo): Bump to 15.1.0	2026-01-14 10:23:46 +01:00
mrtz	8f61e63f29	fix(forgejo): rm location for minio	2026-01-13 16:35:47 +01:00
mrtz	621598dee3	fix(forgejo): Move endpoint to envs	2026-01-13 16:30:46 +01:00
mrtz	0689bd47f2	fix(forgejo): Remove port	2026-01-13 16:23:13 +01:00
mrtz	006efc31c2	fix(forgejo): Use SSL	2026-01-13 16:20:13 +01:00
mrtz	9d45101ed9	fix(forgejo): Valid minio endpoint	2026-01-13 16:15:18 +01:00
mrtz	d630bdebef	fix(forgejo): Type minioc -> minio	2026-01-13 16:12:06 +01:00
mrtz	8182141bc1	fix(forgejo): Add s3 for packages	2026-01-13 16:08:25 +01:00
Radovan Bast	dc67fa2271	ci: makai	2026-01-13 13:16:11 +00:00
simkir	37ea2ad85c	ci: atlantis	2026-01-13 12:37:37 +00:00
Radovan Bast	6a5da41480	ci: makai	2026-01-13 12:23:36 +00:00
Radovan Bast	cd25aa8a1a	ci: makai	2026-01-13 11:56:21 +00:00
Radovan Bast	05a3a69976	ci: makai	2026-01-12 17:03:01 +00:00
simkir	0697a4da10	ci: codex	2026-01-12 16:43:47 +00:00
simkir	8d5443e126	Bump codex 0.0.1-beta.2 -> 0.0.1-beta.3	2026-01-12 17:42:25 +01:00
simkir	b32e0643fb	ci: codex	2026-01-12 13:48:28 +00:00
mrtz	af7f4c8116	ci: codex	2026-01-12 13:44:58 +00:00
mrtz	37bb29b36a	ci: atlantis	2026-01-12 13:44:49 +00:00
simkir	af04b27c10	Bump codex 0.0.1-beta.1 -> 0.0.1-beta.2	2026-01-12 14:36:23 +01:00
Radovan Bast	a42010546f	ci: makai	2026-01-12 11:35:36 +00:00
mrtz	7034d20e39	fix(velero): Working version of kubectl	2026-01-12 10:16:32 +01:00
mrtz	dbdfcb4f21	fix(velero): Bump plugin and remove legacy kubectl	2026-01-12 10:02:02 +01:00
mrtz	22148fb162	fix(velero): Bump to 11.3.2	2026-01-12 09:58:48 +01:00
mrtz	3086214bac	ci: atlantis	2026-01-11 14:27:07 +00:00
mrtz	e6c99a8567	chore: Bump nixpkgs	2026-01-11 14:05:38 +01:00
mrtz	fa9d45fbb7	fix(forgejo): Remove LB	2026-01-09 15:53:38 +01:00
mrtz	72eb20fb5b	fix(forgejo): Change realm	2026-01-09 15:20:17 +01:00
mrtz	eb141a7efe	fix(forgejo): Add OIDC login	2026-01-09 15:04:38 +01:00
mrtz	773550df56	fix(forgejo): Add back whitelist	2026-01-09 14:34:53 +01:00
mrtz	a93173066d	fix(forgejo): Remove ssh via LB for now	2026-01-09 14:33:26 +01:00
simkir	b39ed6cc54	fix(codex): Set port for fga url	2026-01-09 14:32:23 +01:00
mrtz	685328685b	fix(forgejo): Use secrets for DB	2026-01-09 14:28:59 +01:00
simkir	40beab6e4f	fix(codex): Remove codex.oceanbox.io from ing hosts	2026-01-09 14:21:39 +01:00
mrtz	46c890c6c3	fix(forgjo): Remove comments in dragonfly	2026-01-09 14:20:53 +01:00
simkir	aaa7cf4a6e	fix(codex): Rm codex.oceanbox.io from ing tls hosts	2026-01-09 14:19:44 +01:00
simkir	55d385ea6a	fix(codex): Set correct openfga url	2026-01-09 14:19:44 +01:00
mrtz	80ebe7c278	fix(forgejo): Limit cpu count dragonfly	2026-01-09 14:19:01 +01:00
mrtz	cf5b0273c2	fix(forgejo): Increase dragonfly RAM	2026-01-09 14:13:51 +01:00
mrtz	c8ec4161aa	fix(forgejo): Move to sys and	2026-01-09 13:55:32 +01:00
simkir	59580b5d29	fix(nginx): Move error page to 503	2026-01-08 14:42:33 +01:00
simkir	ddc8c7b253	Add simkir-maps.dev.oceanbox.io to ts dns	2026-01-08 14:32:19 +01:00
simkir	36f0f11ef6	Add codex.adm.oceanbox.io to ts dns	2026-01-08 14:32:02 +01:00
simkir	ea1a0a2eb5	Add custom 404.html to nginx default backend	2026-01-08 14:25:22 +01:00
simkir	ffb572e762	fix(nginx): Set default backend to custom-error-pages	2026-01-08 14:10:26 +01:00
Radovan Bast	f46ca7d2be	ci: makai	2026-01-08 11:29:28 +00:00
Radovan Bast	2cd14292d2	ci: makai	2026-01-08 09:48:30 +00:00
mrtz	9470c73e92	fix(forgejo): Correct s3 url	2026-01-08 08:50:33 +01:00
mrtz	922e2fd0ea	feat: Add forgejo	2026-01-07 23:22:08 +01:00
Radovan Bast	8c2f6d53c9	ci: makai	2026-01-07 14:22:11 +00:00
simkir	7041b91c45	fix(codex): Add codex.adm.oceanbox.io ing. path	2026-01-07 15:02:20 +01:00
simkir	a1c3f766b5	fix(codex): Rename prod ing tls secret to prod	2026-01-07 14:55:50 +01:00
simkir	d5e6d86f4b	Bump codex 0.0.0-alpha.1 -> 0.0.1-beta.1	2026-01-07 14:33:06 +01:00
simkir	608fae0bf1	ci: codex	2026-01-07 13:29:09 +00:00
simkir	d3fd3b7c5b	fix(codex): Mount correct cm	2026-01-07 14:20:54 +01:00
simkir	556756d0a0	Rename codex prod appsettings file	2026-01-07 14:18:53 +01:00
simkir	d242c23ae3	Rename prod codex cilium network policy	2026-01-07 14:16:14 +01:00
simkir	3255430a3b	Add prod codex	2026-01-07 14:10:49 +01:00
Radovan Bast	7594dfe93d	ci: makai	2026-01-07 11:28:39 +00:00
mrtz	616a1915f2	fix(atlantis): Staging should use app instead of superuser secret	2026-01-07 11:24:26 +01:00
Radovan Bast	de6963de12	ci: makai	2026-01-06 10:34:18 +00:00
juselius	5d8a4056e3	Merge branch 'main' of gitlab.com:oceanbox/manifests	2026-01-06 10:52:31 +01:00
juselius	9c9c87bf2f	fix: add intern to headscale acl	2026-01-06 10:52:26 +01:00
Radovan Bast	89a54a995d	ci: makai	2026-01-06 09:12:43 +00:00
juselius	707c37b9f1	fix: add faith to headscale acl	2026-01-05 15:45:47 +01:00
Radovan Bast	14ae0e358b	ci: makai	2026-01-05 14:44:07 +00:00
simkir	ef82ce7bc5	ci: sorcerer	2026-01-05 14:04:34 +00:00
simkir	d4d9d9a3b6	ci: atlantis	2026-01-05 14:04:27 +00:00
mrtz	f55fd396fc	ci: sorcerer	2026-01-05 13:23:48 +00:00
mrtz	91e98e3949	ci: atlantis	2026-01-05 13:23:41 +00:00
mrtz	40eb429c17	Merge branch 'renovate/opentelemetry-collector-0.x' into 'main' Update Helm release opentelemetry-collector to v0.142.1 See merge request oceanbox/manifests!58	2026-01-05 12:27:26 +01:00
mrtz	432a73a4ba	Merge branch 'renovate/kyverno-3.x' into 'main' Update Helm release kyverno to v3.6.1 See merge request oceanbox/manifests!40	2026-01-05 10:19:45 +01:00
mrtz	de4ab27a2d	Merge branch 'renovate/argocd-apps-2.x' into 'main' Update Helm release argocd-apps to v2 See merge request oceanbox/manifests!63	2026-01-05 10:18:15 +01:00
mrtz	def3f19dff	fix(makai): Correct path for new container reg	2026-01-05 09:05:16 +01:00
Radovan Bast	3336c9782c	ci: makai	2026-01-05 07:39:46 +00:00
Radovan Bast	b943caef06	ci: makai	2026-01-04 17:56:42 +00:00
mrtz	83a3cece0b	Merge branch 'renovate/registry-3.x' into 'main' Update registry Docker tag to v3 See merge request oceanbox/manifests!66	2026-01-04 11:29:24 +01:00
mrtz	2155c4c654	Merge branch 'renovate/openfga-0.x' into 'main' Update Helm release openfga to v0.2.50 See merge request oceanbox/manifests!54	2026-01-04 11:02:48 +01:00
mrtz	13e44a495f	Merge branch 'renovate/slurm-operator-0.x' into 'main' Update slurm-operator Docker tag to v0.4.1 See merge request oceanbox/manifests!55	2026-01-04 11:02:03 +01:00
mrtz	923f2b81b9	Merge branch 'renovate/cloudnative-pg-0.x' into 'main' Update Helm release cloudnative-pg to v0.27.0 See merge request oceanbox/manifests!56	2026-01-04 10:58:21 +01:00
mrtz	fad034ca44	Merge branch 'renovate/mariadb-operator-25.x' into 'main' Update Helm release mariadb-operator to v25.10.3 See merge request oceanbox/manifests!57	2026-01-04 10:54:03 +01:00
Renovate Bot	31d1918b86	Update registry Docker tag to v3	2026-01-04 08:59:02 +00:00
Renovate Bot	34181f92b1	Update Helm release argocd-apps to v2	2026-01-04 08:58:55 +00:00
Renovate Bot	1d8b1bebcd	Update Helm release opentelemetry-collector to v0.142.1	2026-01-04 08:58:42 +00:00
Renovate Bot	91fba971e2	Update Helm release mariadb-operator to v25.10.3	2026-01-04 08:58:39 +00:00
Renovate Bot	4bb68c68a8	Update Helm release kyverno to v3.6.1	2026-01-04 08:58:33 +00:00
Renovate Bot	4fe9cfee86	Update Helm release cloudnative-pg to v0.27.0	2026-01-04 08:58:17 +00:00
Renovate Bot	c580b22ff5	Update slurm-operator Docker tag to v0.4.1	2026-01-04 08:58:10 +00:00
Renovate Bot	988ba5a4c2	Update Helm release openfga to v0.2.50	2026-01-04 08:58:07 +00:00
mrtz	e9e72da86a	fix(headscale): Add Ole	2026-01-02 17:02:02 +01:00
juselius	a1c1022465	fix: fix ca issuer	2025-12-30 14:37:26 +01:00
mrtz	4de318d814	fix(hel1): Default cluster-ca	2025-12-30 14:14:52 +01:00
mrtz	7402bad7a4	fix(hel1): Add adm to default url	2025-12-30 13:59:48 +01:00
mrtz	113a582649	fix(hel1): Update base url	2025-12-30 13:54:55 +01:00
mrtz	73b8b11088	Merge branch 'automated/npins-update-20251230' into 'main' chore: update npins dependencies See merge request oceanbox/manifests!52	2025-12-30 10:40:41 +01:00
mrtz	f6854b72c8	chore: update npins dependencies Automated update of Nix dependencies via npins. Updated packages: + "hash": "18hsj84ndffq8dz2nh7mv2xib113lxc83spkg3csgzw0agpmkris"	2025-12-30 09:39:02 +00:00
mrtz	bb1078b0f2	fix: Disable old ci	2025-12-30 10:35:19 +01:00
mrtz	983fa68f6a	chore: Add ci	2025-12-30 10:34:27 +01:00
mrtz	9876d5bec5	ci(nix): Add CI shell	2025-12-30 10:25:44 +01:00
mrtz	b6af70c8ca	fix(umami): Disable telemetry	2025-12-29 13:34:11 +01:00
mrtz	957526a6bc	fix(rules/bootstrap): Format yaml	2025-12-29 13:23:04 +01:00
mrtz	f81a4b2732	treewide: Format with shellcheck, jsonlint and yamllint	2025-12-29 12:41:13 +01:00
mrtz	d7e4fb43cb	fix(cert-manager): Bump to latest release	2025-12-29 11:10:12 +01:00
mrtz	e94ed8155e	fix(cert-manager): Switch to oci registry	2025-12-29 11:01:52 +01:00
juselius	c8a0a98167	fix: update gatus to adm.hel1.obx	2025-12-28 14:36:33 +01:00
mrtz	9cddd9b404	ci: sorcerer	2025-12-22 12:21:24 +00:00
mrtz	3df44cd4b2	ci: atlantis	2025-12-22 12:21:18 +00:00
Radovan Bast	53ac794bd6	ci: makai	2025-12-22 08:35:04 +00:00
Radovan Bast	f1a382c76c	ci: makai	2025-12-19 21:01:38 +00:00
Radovan Bast	7a7459db10	ci: makai	2025-12-19 20:49:01 +00:00
Radovan Bast	ed3515c752	ci: makai	2025-12-19 15:48:31 +00:00
juselius	19457af158	ci: fornix	2025-12-19 15:20:13 +00:00
Radovan Bast	e455612874	ci: makai	2025-12-19 14:44:18 +00:00
Radovan Bast	df757cf361	ci: makai	2025-12-19 14:27:49 +00:00
juselius	eb8f6e83ca	ci: fornix	2025-12-19 10:55:33 +00:00
juselius	1668c8db54	ci: fornix	2025-12-19 10:53:07 +00:00
juselius	d739c3d1b1	ci: fornix	2025-12-18 14:42:21 +00:00
juselius	10393587b2	ci: fornix	2025-12-18 09:12:46 +00:00
Radovan Bast	64e5b26352	ci: makai	2025-12-18 09:00:22 +00:00
juselius	49ad715025	fix: argh!!!	2025-12-18 09:51:17 +01:00
juselius	ee6f7e1d56	fix: argh...	2025-12-18 09:46:59 +01:00
juselius	468eaeed88	Merge branch 'main' of gitlab.com:oceanbox/manifests	2025-12-18 09:45:42 +01:00
juselius	257a55fab7	fix: add composer.lock to persistent drupal	2025-12-18 09:43:35 +01:00
juselius	6fb44f6ba4	ci: fornix	2025-12-18 08:40:27 +00:00
juselius	b456dbc0ff	fix: add BASE_URL env to drupal deployment	2025-12-18 09:16:35 +01:00
Radovan Bast	c415754e46	ci: makai	2025-12-18 07:46:03 +00:00
Radovan Bast	2688f381ef	ci: makai	2025-12-17 14:49:42 +00:00
juselius	10c6708bd4	ci: fornix	2025-12-17 13:58:32 +00:00
juselius	a07e19b22c	fix: disable diagrid dashboard	2025-12-17 14:36:16 +01:00
juselius	2e9dc96ded	fix: disable /data path kustomization in sorcerer	2025-12-17 14:13:18 +01:00
juselius	0348b1d46f	fix: fix diagrid dasboard statestore config	2025-12-17 14:06:55 +01:00
juselius	22383f1d88	fix: update helmfile container	2025-12-17 13:52:51 +01:00
juselius	e2641b18b6	Merge branch 'main' of gitlab.com:oceanbox/manifests	2025-12-17 13:50:20 +01:00
juselius	86240fc085	fix: enable probes on diagrid-dashboard	2025-12-17 13:50:12 +01:00
Radovan Bast	799b6c2858	ci: makai	2025-12-17 11:46:38 +00:00
Radovan Bast	daa5b60c43	ci: makai	2025-12-17 09:58:16 +00:00
juselius	ca0a228660	feat: enable diagrid dashboard for staging sorcerer	2025-12-17 10:54:42 +01:00
juselius	621945dbf2	Merge remote-tracking branch 'origin/diadash'	2025-12-17 10:46:53 +01:00
Radovan Bast	847c70b547	ci: makai	2025-12-17 08:59:00 +00:00
juselius	40a04b72ae	ci: fornix	2025-12-17 08:40:11 +00:00
juselius	457a260d0e	ci: fornix	2025-12-17 07:51:12 +00:00
Radovan Bast	49b2992a41	ci: makai	2025-12-16 19:57:00 +00:00
juselius	605581fc40	feat: add diagrid workflow dashboard subchart sorcerer and atlantis	2025-12-16 19:55:59 +01:00