Compare commits
1 Commits
nexus
..
otel-policy
| Author | SHA1 | Date | |
|---|---|---|---|
 hanssenkai
|
f9838604e8 |
@@ -1,12 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# the shebang is ignored, but nice for editors
|
||||
watch_file nix/sources.json
|
||||
|
||||
# Load .env file if it exists
|
||||
dotenv_if_exists
|
||||
|
||||
# Set npins dir
|
||||
export NPINS_DIRECTORY="nix"
|
||||
|
||||
# Activate development shell
|
||||
use nix
|
||||
+2
-6
@@ -1,6 +1,2 @@
|
||||
*.tgz
|
||||
_*/
|
||||
.direnv/
|
||||
.pre-commit-config.yaml
|
||||
_*.yaml
|
||||
backup/
|
||||
_manifest.yaml
|
||||
_resources.yaml
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
# Manifests
|
||||
|
||||
> [!note]
|
||||
> For CI/CD to push updates to this repo add your repo [here](https://gitlab.com/oceanbox/alpine-k8s/-/settings/ci_cd#js-token-access)
|
||||
|
||||
Manifest repo managed using [Helmfile](https://github.com/helmfile/helmfile).
|
||||
|
||||
Repository structure:
|
||||
|
||||
```bash
|
||||
/
|
||||
├── helmfile.d/ # Helmfiles, *.yaml.gotmpl
|
||||
├── charts/ # Our own charts, e.g `Atlantis`
|
||||
├── values # Values for helmfiles
|
||||
│ ├── <chart>
|
||||
│ │ ├── env.yaml.gotmpl # Values to be templated in `values/`
|
||||
│ │ ├── kustomize # Kustomizations per environment
|
||||
│ │ ├── manifests # Raw manifests
|
||||
│ │ │ ├── <chart>.yaml # Argo App for bootstrap
|
||||
│ │ │ ├── dashboards # Grafana dashboards
|
||||
│ │ │ │ └── <chart>-metrics.yaml
|
||||
│ │ │ └── policies # Cilium and Kyverno policies
|
||||
│ │ │ ├── CiliumNetworkPolicy-allow-api-server.yaml
|
||||
│ │ │ └── KyvernoPolicy-regred-secret.yaml
|
||||
│ │ └── values # Values for each environment
|
||||
│ │ ├── <chart>-staging.yaml.gotmpl # Values for staging environment
|
||||
│ │ ├── <chart>-prod.yaml.gotmpl # Values for prod environment
|
||||
│ │ └── <chart>.yaml.gotmpl # Standard values for all environments
|
||||
│ │
|
||||
│ ├── env.yaml # Standard values for all cluster
|
||||
│ ├── env-oceanbox.yaml # Values overrides for oceanbox
|
||||
│ ├── env-ekman.yaml # Values overrides for ekman
|
||||
```
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: archmeister
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: archmeister.srv.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
hostname: archmeister.beta.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .env }}-archmeister"
|
||||
spec:
|
||||
project: atlantis
|
||||
destination:
|
||||
namespace: atlantis
|
||||
server: "{{ .cluster }}"
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/archmeister
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: "{{ .env }}"
|
||||
- name: hostname
|
||||
string: "{{ .hostname }}"
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: atlantis-host-cluster-resources
|
||||
namespace: argocd
|
||||
# annotations: # close, but no cigar
|
||||
# argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: false
|
||||
selfHeal: false
|
||||
ignoreDifferences:
|
||||
- kind: Secret
|
||||
name: prod-rabbitmq
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.annotations.clone'
|
||||
- '.metadata.labels'
|
||||
- kind: Secret
|
||||
name: prod-redis
|
||||
jqPathExpressions:
|
||||
- '.data'
|
||||
- '.metadata.annotations.clone'
|
||||
- '.metadata.labels'
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: resources/atlantis/host-manifests
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: 'resources/atlantis/manifests/prod'
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
# Currently not in use. Configured via the create-vcluster script.
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: atlantis-resources
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
autoSync: false
|
||||
prune: false
|
||||
# - cluster: https://staging-vcluster.staging-vcluster
|
||||
# env: staging
|
||||
# autoSync: false
|
||||
# prune: false
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .env }}-atlantis-resources"
|
||||
spec:
|
||||
project: aux
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
destination:
|
||||
server: "{{ .cluster }}"
|
||||
namespace: atlantis
|
||||
sources: {}
|
||||
# - repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
# targetRevision: main
|
||||
# path: 'resources/atlantis/manifests/{{ env }}'
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: atlantis
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: atlantis.srv.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
hostname: atlantis.beta.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ .env }}-atlantis'
|
||||
spec:
|
||||
project: atlantis
|
||||
destination:
|
||||
namespace: atlantis
|
||||
server: '{{ .cluster }}'
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/atlantis
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ .env }}'
|
||||
- name: hostname
|
||||
string: '{{ .hostname }}'
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: busynix
|
||||
namespace: argocd
|
||||
spec:
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
# - cluster: https://kubernetes.default.svc
|
||||
# env: prod
|
||||
# hostname: busynix.srv.oceanbox.io
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
hostname: busynix.beta.oceanbox.io
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ env }}-busynix'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
namespace: default
|
||||
server: '{{ cluster }}'
|
||||
source:
|
||||
repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/busynix
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ env }}'
|
||||
- name: hostname
|
||||
string: '{{ hostname }}'
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: cerbos
|
||||
namespace: argocd
|
||||
spec:
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ env }}-cerbos'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: idp
|
||||
sources:
|
||||
- repoURL: https://download.cerbos.dev/helm-charts
|
||||
targetRevision: 0.33.0
|
||||
chart: cerbos
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/kustomizations/cerbos/values.yaml
|
||||
- $values/kustomizations/cerbos/values-{{ env }}.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: dex
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: idp
|
||||
source:
|
||||
repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/dex/manifests
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: geoserver
|
||||
namespace: argocd
|
||||
spec:
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: geoserver.srv.oceanbox.io
|
||||
# - cluster: https://kubernetes.default.svc
|
||||
# env: staging
|
||||
# hostname: geoserver.beta.oceanbox.io
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ env }}-geoserver'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: geoserver
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/geoserver
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ env }}'
|
||||
- name: hostname
|
||||
string: geoserver.srv.oceanbox.io
|
||||
- name: flags
|
||||
string: "--skip-tests"
|
||||
- name: chart
|
||||
string: ncsa/geoserver
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: hipster
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: hipster.srv.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
hostname: hipster.beta.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ .env }}-hipster'
|
||||
spec:
|
||||
project: atlantis
|
||||
destination:
|
||||
namespace: atlantis
|
||||
server: '{{ .cluster }}'
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/hipster
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ .env }}'
|
||||
- name: hostname
|
||||
string: '{{ .hostname }}'
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.jaeger-operator.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -15,10 +14,9 @@ spec:
|
||||
chart: jaeger-operator
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/jaeger/values.yaml
|
||||
- $values/kustomizations/jaeger/values.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
# path: values/jaeger/manifests
|
||||
# path: kustomizations/jaeger/manifests
|
||||
ref: values
|
||||
|
||||
{{- end }}
|
||||
@@ -1,23 +1,21 @@
|
||||
{{- if .Values.headscale.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: headscale
|
||||
name: keycloak
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: headscale
|
||||
namespace: idp
|
||||
sources:
|
||||
- repoURL: https://charts.gabe565.com
|
||||
targetRevision: 0.16.0
|
||||
chart: headscale
|
||||
- repoURL: https://charts.bitnami.com/bitnami
|
||||
targetRevision: 24.0.2
|
||||
chart: keycloak
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/headscale/values.yaml
|
||||
- $values/kustomizations/keycloak/values.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.loki.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -29,8 +28,8 @@ spec:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
path: policies/oceanbox/network/loki
|
||||
- repoURL: https://gitlab.com/serit/k8s/serit-platform-manifests.git
|
||||
path: network-policies/netpol-loki
|
||||
targetRevision: HEAD
|
||||
- repoURL: 'https://grafana.github.io/helm-charts'
|
||||
targetRevision: 6.12.0
|
||||
@@ -47,8 +46,8 @@ spec:
|
||||
s3:
|
||||
endpoint: http://10.255.241.30:30080
|
||||
region: tos
|
||||
accessKeyId: ${S3KEY}
|
||||
secretAccessKey: ${S3SECRET}
|
||||
accessKeyId: ${S3KEY}
|
||||
s3ForcePathStyle: true
|
||||
http_config:
|
||||
insecure_skip_verify: true
|
||||
@@ -114,7 +113,7 @@ spec:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
oceanbox.io/expose: internal
|
||||
atlantis.oceanbox.io/expose: internal
|
||||
hosts:
|
||||
- loki.adm.oceanbox.io
|
||||
tls:
|
||||
@@ -149,4 +148,3 @@ spec:
|
||||
secretKeyRef:
|
||||
name: loki-s3
|
||||
key: AWS_ACCESS_KEY_SECRET
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: openfga
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: openfga.adm.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: staging
|
||||
hostname: openfga.dev.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ .env }}-openfga'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
namespace: idp
|
||||
server: '{{ .cluster }}'
|
||||
sources:
|
||||
- repoURL: https://openfga.github.io/helm-charts
|
||||
targetRevision: 0.2.12
|
||||
chart: openfga
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/kustomizations/openfga/values.yaml
|
||||
- $values/kustomizations/openfga/values-{{ .env }}.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.opentelemetry-collector.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -32,9 +31,6 @@ spec:
|
||||
mode: deployment
|
||||
image:
|
||||
repository: otel/opentelemetry-collector-k8s
|
||||
service:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: 10.255.241.12
|
||||
config:
|
||||
receivers:
|
||||
prometheus/collector:
|
||||
@@ -92,11 +88,11 @@ spec:
|
||||
# logsCollection:
|
||||
# enabled: true
|
||||
ingress:
|
||||
enabled: false
|
||||
enabled: true
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
oceanbox.io/expose: internal
|
||||
atlantis.oceanbox.io/expose: internal
|
||||
ingressClassName: nginx
|
||||
hosts:
|
||||
- host: opentelemetry-collector.adm.oceanbox.io
|
||||
@@ -108,4 +104,3 @@ spec:
|
||||
- secretName: collector-tls
|
||||
hosts:
|
||||
- opentelemetry-collector.adm.oceanbox.io
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.osm-tile-server.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
@@ -16,21 +15,20 @@ spec:
|
||||
hostname: osm.beta.oceanbox.io
|
||||
template:
|
||||
metadata:
|
||||
name: '{{- env }}-osm-tile-server'
|
||||
name: '{{ env }}-osm-tile-server'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
namespace: oceanbox
|
||||
server: '{{- cluster }}'
|
||||
server: '{{ cluster }}'
|
||||
source:
|
||||
repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: HEAD
|
||||
path: values/osm-tile-server
|
||||
path: kustomizations/osm-tile-server
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{- env }}'
|
||||
string: '{{ env }}'
|
||||
- name: hostname
|
||||
string: '{{- hostname }}'
|
||||
{{- end }}
|
||||
string: '{{ hostname }}'
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: petimeter
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
hostname: petimeter.srv.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://staging-vcluster.staging-vcluster
|
||||
env: staging
|
||||
hostname: petimeter.beta.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ .env }}-petimeter'
|
||||
spec:
|
||||
project: atlantis
|
||||
destination:
|
||||
namespace: atlantis
|
||||
server: '{{ .cluster }}'
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/petimeter
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ .env }}'
|
||||
- name: hostname
|
||||
string: '{{ .hostname }}'
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/petimeter/manifests
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.rabbitmq.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
@@ -16,7 +15,7 @@ spec:
|
||||
hostname: rabbitmq.beta.oceanbox.io
|
||||
template:
|
||||
metadata:
|
||||
name: '{{- env }}-rabbitmq'
|
||||
name: '{{ env }}-rabbitmq'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
@@ -28,9 +27,8 @@ spec:
|
||||
chart: rabbitmq
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/rabbitmq/values-{{- env }}.yaml
|
||||
- $values/kustomizations/rabbitmq/values-{{ env }}.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: values/rabbitmq/{{- env }}
|
||||
path: kustomizations/rabbitmq/{{ env }}
|
||||
ref: values
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: argocd
|
||||
spec:
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: prod
|
||||
- cluster: https://kubernetes.default.svc
|
||||
env: staging
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ env }}-redis'
|
||||
spec:
|
||||
project: aux
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: redis
|
||||
sources:
|
||||
- repoURL: https://charts.bitnami.com/bitnami
|
||||
targetRevision: 19.5.2
|
||||
chart: redis
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/kustomizations/redis/values-{{ env }}.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: HEAD
|
||||
ref: values
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/redis/{{ env }}
|
||||
ignoreDifferences:
|
||||
- group: apps
|
||||
kind: StatefulSet
|
||||
jqPathExpressions:
|
||||
- '.spec.template.spec.containers[].resources.limits.cpu'
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.seq.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -15,8 +14,7 @@ spec:
|
||||
chart: seq
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/seq/values.yaml
|
||||
- $values/kustomizations/seq/values.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
ref: values
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: sorcerer
|
||||
namespace: argocd
|
||||
spec:
|
||||
goTemplate: true
|
||||
generators:
|
||||
- list:
|
||||
elements:
|
||||
- cluster: https://10.255.241.99:4443
|
||||
env: prod
|
||||
hostname: sorcerer.data.oceanbox.io
|
||||
autoSync: false
|
||||
prune: true
|
||||
- cluster: https://10.255.241.99:4443
|
||||
env: staging
|
||||
hostname: sorcerer.ekman.oceanbox.io
|
||||
autoSync: true
|
||||
prune: true
|
||||
template:
|
||||
metadata:
|
||||
name: '{{ .env }}-sorcerer'
|
||||
spec:
|
||||
project: atlantis
|
||||
destination:
|
||||
namespace: sorcerer
|
||||
server: '{{ .cluster }}'
|
||||
sources:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: kustomizations/sorcerer
|
||||
plugin:
|
||||
name: kustomize-helm-with-rewrite
|
||||
parameters:
|
||||
- name: env
|
||||
string: '{{ .env }}'
|
||||
- name: hostname
|
||||
string: '{{ .hostname }}'
|
||||
templatePatch: |
|
||||
{{- if .autoSync }}
|
||||
spec:
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: {{ .prune }}
|
||||
selfHeal: false
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.tempo.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -35,11 +34,11 @@ spec:
|
||||
backend: s3
|
||||
s3:
|
||||
bucket: tempo-traces
|
||||
endpoint: 10.255.241.30:30080
|
||||
access_key: ${S3KEY}
|
||||
secret_key: ${S3SECRET}
|
||||
forcepathstyle: true
|
||||
endpoint: http://10.255.241.30:30080
|
||||
access_key: ${S3SECRET}
|
||||
secret_key: ${S3KEY}
|
||||
insecure: true
|
||||
backend: local
|
||||
local:
|
||||
path: /var/tempo/traces
|
||||
wal:
|
||||
@@ -47,7 +46,6 @@ spec:
|
||||
metricsGenerator:
|
||||
enabled: true
|
||||
remoteWriteUrl: "http://prom-prometheus.prometheus:9090/api/v1/write"
|
||||
extraArgs: { config.expand-env=true }
|
||||
extraEnv:
|
||||
- name: S3KEY
|
||||
valueFrom:
|
||||
@@ -66,7 +64,7 @@ spec:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
oceanbox.io/expose: internal
|
||||
atlantis.oceanbox.io/expose: internal
|
||||
path: /
|
||||
pathType: Prefix
|
||||
hosts:
|
||||
@@ -75,4 +73,3 @@ spec:
|
||||
- secretName: tempo-query-tls
|
||||
hosts:
|
||||
- query.tempo.adm.oceanbox.io
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.wordpress.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -15,8 +14,7 @@ spec:
|
||||
chart: wordpress
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/values/wordpress/values.yaml
|
||||
- $values/wordpress/values.yaml
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: HEAD
|
||||
ref: values
|
||||
{{- end }}
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- if .Values.yolo-dl.enabled }}
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
@@ -13,4 +12,3 @@ spec:
|
||||
- repoURL: https://gitlab.com/oceanbox/manifests.git
|
||||
targetRevision: main
|
||||
path: charts/yolo-dl
|
||||
{{- end }}
|
||||
@@ -1,14 +1,14 @@
|
||||
apiVersion: v1
|
||||
stringData:
|
||||
config: '{"bearerToken":"@token@","tlsClientConfig":{"insecure":true}}'
|
||||
config: |
|
||||
{"bearerToken":"","tlsClientConfig":{"insecure":true}}
|
||||
name: ekman
|
||||
server: https://10.255.241.99:4443
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
argocd.argoproj.io/secret-type: cluster
|
||||
name: cluster-ekman
|
||||
name: cluster-10.255.241.99-4046803085
|
||||
namespace: argocd
|
||||
type: Opaque
|
||||
|
||||
|
||||
Executable → Regular
+1
-1
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
|
||||
img=registry.gitlab.com/oceanbox/manifests/kustomize-helm-with-rewrite
|
||||
tag=${1:-latest}
|
||||
|
||||
docker build -t $img:$tag .
|
||||
+2
-3
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
export HOME=/plugin
|
||||
export HOME=/helm-working-dir
|
||||
|
||||
env > /tmp/$ARGOCD_APP_NAME.env
|
||||
|
||||
@@ -23,12 +23,11 @@ fi
|
||||
[ -f values-$PARAM_ENV.yaml ] && VALUES="$VALUES -f values-$PARAM_ENV.yaml"
|
||||
VALUES="$VALUES -f parameters.yaml"
|
||||
|
||||
helm dependency update $CHART >/tmp/$ARGOCD_APP_NAME-helm-dependency-build.out
|
||||
|
||||
mkdir -p base
|
||||
echo "helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART" > /tmp/$ARGOCD_APP_NAME-helm.sh
|
||||
helm template -n $ARGOCD_APP_NAMESPACE $PARAM_FLAGS $VALUES $ARGOCD_APP_NAME $CHART > ./base/_manifest.yaml
|
||||
|
||||
sed -i "$PARAM_REWRITE" ./base/_manifest.yaml
|
||||
cp ./base/_manifest.yaml /tmp/$ARGOCD_APP_NAME-manifest.yaml
|
||||
|
||||
[ -d "$PARAM_ENV" ] && kubectl kustomize $PARAM_ENV > /tmp/$ARGOCD_APP_NAME-manifest.yaml
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
export HOME=/plugin
|
||||
export HOME=/helm-working-dir
|
||||
|
||||
helm repo add --username argocd-helm --password "$OCEANBOX_HELM_ACCESS_TOKEN" oceanbox \
|
||||
https://gitlab.com/api/v4/projects/54396343/packages/helm/stable
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
export HOME=/plugin
|
||||
export HOME=/helm-working-dir
|
||||
|
||||
helm repo update oceanbox
|
||||
|
||||
+10
-3
@@ -1,7 +1,7 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ConfigManagementPlugin
|
||||
metadata:
|
||||
name: helm-kustomize-cmp
|
||||
name: kustomize-helm-with-rewrite
|
||||
spec:
|
||||
# version: v1.2
|
||||
# The init command runs in the Application source directory at the beginning of each manifest generation. The init
|
||||
@@ -52,6 +52,13 @@ spec:
|
||||
itemType: string
|
||||
collectionType: string
|
||||
string: "staging"
|
||||
- name: rewrite
|
||||
title: Rewrite
|
||||
tooltip: sed rewrite experssion
|
||||
required: false
|
||||
itemType: string
|
||||
collectionType: string
|
||||
string: ""
|
||||
- name: chart
|
||||
title: Chart
|
||||
tooltip: Name or path of helm chart
|
||||
@@ -76,10 +83,10 @@ spec:
|
||||
# map:
|
||||
# some: value
|
||||
# collectionType: map
|
||||
# dynamic:
|
||||
dynamic:
|
||||
# The command is run in an Application's source directory. Standard output must be JSON matching the schema of the
|
||||
# static parameter announcements list.
|
||||
# command: [ /bin/sh, /plugin/get-values.sh ]
|
||||
command: [ /bin/sh, /plugin/get-values.sh ]
|
||||
|
||||
# If set to `true` then the plugin receives repository files with original file mode. Dangerous since the repository
|
||||
# might have executable files. Set to true only if you trust the CMP plugin authors.
|
||||
@@ -1,26 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
*.nix
|
||||
old/
|
||||
nix/
|
||||
@@ -1,27 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: sys
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
dependencies: # A list of the chart requirements (optional)
|
||||
- name: sys-cilium-policies
|
||||
condition: cilium.enabled
|
||||
@@ -1,23 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: cilium
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-applicationset-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-notifications
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD Notifications
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: slack.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access-applicationset
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo Applicationset
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-argo-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the ArgoCD repo server
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: repo-server
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-chartmuseum-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the chartmuseum ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: chartmuseum
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-image-updater-repo-access
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD image updater to access github container registry
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: ghcr.io
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-image-updater
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-ingress
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access from the ingress controller
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Kube API server
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-microsoft-sso
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: github.com
|
||||
- matchName: api.github.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-rollout
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-rollouts
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8090"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics-workflows
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argo-workflows
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "9090"
|
||||
protocol: TCP
|
||||
-30
@@ -1,30 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: argocd
|
||||
spec:
|
||||
description: Allow access to the Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: argocd
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8082"
|
||||
protocol: TCP
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
- port: "9001"
|
||||
protocol: TCP
|
||||
- port: "9121"
|
||||
protocol: TCP
|
||||
- port: "8084"
|
||||
protocol: TCP
|
||||
- port: "8083"
|
||||
protocol: TCP
|
||||
- port: "5558"
|
||||
protocol: TCP
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server-to-cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the API server to communicate with the cert-manager pods
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the Kube API server to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow Prometheus metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9402"
|
||||
protocol: TCP
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-traffic
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
description: Allow the world to communicate with cert-manager
|
||||
egress:
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-server
|
||||
namespace: cilium-spire
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8081"
|
||||
protocol: TCP
|
||||
@@ -1,22 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cilium-test
|
||||
spec:
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- {}
|
||||
- toEntities:
|
||||
- cluster
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- toEntities:
|
||||
- world
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
- fromEntities:
|
||||
- world
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-acme-solvers
|
||||
spec:
|
||||
description: Policy for ingress for Acme Solvers.
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
acme.cert-manager.io/http01-solver: "true"
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-24
@@ -1,24 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns
|
||||
spec:
|
||||
description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: NotIn
|
||||
values:
|
||||
- kube-system
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-mariadb-operator
|
||||
spec:
|
||||
description: allow mariadb instances to be reached by operator
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: mariadb
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
app.kubernetes.io/name: mariadb-operator
|
||||
io.kubernetes.pod.namespace: mariadb-operator
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "3306"
|
||||
protocol: TCP
|
||||
-20
@@ -1,20 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: allow-s3-traffic
|
||||
spec:
|
||||
description: Policy for egress for CNPG Backups.
|
||||
egress:
|
||||
- toFQDNs:
|
||||
{{- range .Values.s3.hosts }}
|
||||
- matchName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- range .Values.s3.patterns }}
|
||||
- matchPattern: {{ . | quote }}
|
||||
{{- end }}
|
||||
- toCIDR:
|
||||
{{- range .Values.s3.cidr }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: cilium-health-checks
|
||||
spec:
|
||||
description: Health checks
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
reserved:health: ""
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,9 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: deny-all
|
||||
spec:
|
||||
description: Deny all
|
||||
egress: []
|
||||
endpointSelector: {}
|
||||
ingress: []
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: cnpg
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: postgres-operator
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: cnpg
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kube-downscaler
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
application: downscaler-py-kube-downscaler
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: kube-downscaler
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- host
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchPattern: hubble.*.*.*
|
||||
- matchPattern: hubble.*.*.*.*
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9913"
|
||||
protocol: TCP
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-s3-traffic
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
egress:
|
||||
- toCIDR:
|
||||
- 10.139.2.10/32
|
||||
- toCIDR:
|
||||
- 10.139.2.11/32
|
||||
- toCIDR:
|
||||
- 10.139.2.20/32
|
||||
- toCIDR:
|
||||
- 10.139.2.21/32
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-world-to-ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- world
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: jaeger
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-jaeger
|
||||
namespace: jaeger
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: jaeger-operator
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kafka
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kafka-operator
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-webhooks
|
||||
namespace: kafka
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9443"
|
||||
protocol: TCP
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-controller-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Controller Metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-controller-manager
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "10257"
|
||||
protocol: TCP
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-csi-webhook
|
||||
namespace: kube-system
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: csi-snapshot-webhook
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9153"
|
||||
protocol: TCP
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns-world
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS World
|
||||
egress:
|
||||
- toCIDR:
|
||||
- 8.8.8.8/32
|
||||
- 172.31.254.11/32
|
||||
- 1.1.1.1/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
- toEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-dns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow DNS
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchExpressions:
|
||||
- key: io.kubernetes.pod.namespace
|
||||
operator: Exists
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-host-traffic
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Host Traffic
|
||||
egress:
|
||||
- toEntities:
|
||||
- remote-node
|
||||
- host
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-ingress
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-ui
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-14
@@ -1,14 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-oauth2-ingress
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble OAuth2 ingress
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: oauth2-proxy
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: ingress-nginx
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-hubble-relay-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Hubble Relay Metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: hubble-relay
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "9966"
|
||||
protocol: TCP
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-microsoft-sso
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Microsoft SSO
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: login.microsoftonline.com
|
||||
- matchPattern: '*.microsoftonline.com'
|
||||
- matchName: graph.microsoft.com
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: oauth2-proxy
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-namespace-traffic
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Namespace Traffic
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- {}
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
rules:
|
||||
dns:
|
||||
- matchPattern: '*'
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- {}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-proxy-metrics
|
||||
namespace: kube-system
|
||||
spec:
|
||||
description: Allow Proxy metrics
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-proxy
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "10249"
|
||||
protocol: TCP
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-kube-api
|
||||
namespace: kubelet-serving-cert-approver
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: kyverno
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels: {}
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: kyverno
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kyverno
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
- toPorts:
|
||||
- ports:
|
||||
- port: "8000"
|
||||
protocol: TCP
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-remote-node-to-kyverno
|
||||
namespace: kyverno
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: kyverno
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-loki-backend-to-api-server
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Promtail needs to reach kube-apiserver
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: backend
|
||||
app.kubernetes.io/instance: loki
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-metrics
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Allow Prometheus read and write
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: loki
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
io.kubernetes.pod.namespace: prometheus
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "3100"
|
||||
protocol: TCP
|
||||
- port: "3500"
|
||||
protocol: TCP
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-promtail-to-api-server
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Promtail needs to reach kube-apiserver
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: promtail
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-stats-grafana
|
||||
namespace: loki
|
||||
spec:
|
||||
description: Allow stats
|
||||
egress:
|
||||
- toFQDNs:
|
||||
- matchName: stats.grafana.org
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: loki
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: allow-api-server
|
||||
namespace: mariadb-operator
|
||||
spec:
|
||||
egress:
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: mariadb-operator
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user