feat: add stub sonatype-nexus helmfile

To see more submits in our dashboard

.envrc

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# the shebang is ignored, but nice for editors
+watch_file nix/sources.json
+
+# Load .env file if it exists
+dotenv_if_exists
+
+# Set npins dir
+export NPINS_DIRECTORY="nix"
+
+# Activate development shell
+use nix

.gitignore

@@ -1,3 +1,6 @@
-_manifest.yaml
-_resources.yaml
 *.tgz
+_*/
+.direnv/
+.pre-commit-config.yaml
+_*.yaml
+backup/

README.md

@@ -0,0 +1,33 @@
+# Manifests
+
+> [!note]
+> For CI/CD to push updates to this repo add your repo [here](https://gitlab.com/oceanbox/alpine-k8s/-/settings/ci_cd#js-token-access)
+
+Manifest repo managed using [Helmfile](https://github.com/helmfile/helmfile).
+
+Repository structure:
+
+```bash
+/
+├── helmfile.d/                                                 # Helmfiles, *.yaml.gotmpl
+├── charts/                                                     # Our own charts, e.g `Atlantis`
+├── values                                                      # Values for helmfiles
+│   ├── <chart>
+│   │   ├── env.yaml.gotmpl                                     # Values to be templated in `values/`
+│   │   ├── kustomize                                           # Kustomizations per environment
+│   │   ├── manifests                                           # Raw manifests
+│   │   │   ├── <chart>.yaml                                    # Argo App for bootstrap
+│   │   │   ├── dashboards                                      # Grafana dashboards
+│   │   │   │   └── <chart>-metrics.yaml
+│   │   │   └── policies                                        # Cilium and Kyverno policies
+│   │   │       ├── CiliumNetworkPolicy-allow-api-server.yaml
+│   │   │       └── KyvernoPolicy-regred-secret.yaml
+│   │   └── values                                              # Values for each environment
+│   │       ├── <chart>-staging.yaml.gotmpl                     # Values for staging environment
+│   │       ├── <chart>-prod.yaml.gotmpl                        # Values for prod environment
+│   │       └── <chart>.yaml.gotmpl                             # Standard values for all environments
+│   │
+│   ├── env.yaml                                             # Standard values for all cluster
+│   ├── env-oceanbox.yaml                                    # Values overrides for oceanbox
+│   ├── env-ekman.yaml                                       # Values overrides for ekman
+```

acl.json

@@ -1 +0,0 @@
-kustomizations/petimeter/manifests/acl.json

applications/archmeister.yaml

@@ -1,47 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: archmeister
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: archmeister.srv.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-        hostname: archmeister.beta.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: "{{ .env }}-archmeister"
-    spec:
-      project: atlantis
-      destination:
-        namespace: atlantis
-        server: "{{ .cluster }}"
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/archmeister
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: "{{ .env }}"
-          - name: hostname
-            string: "{{ .hostname }}"
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/atlantis-host-resources.yaml

@@ -1,27 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: atlantis-cluster-resources
-  namespace: argocd
-  # annotations: # close, but no cigar
-  #   argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
-spec:
-  project: atlantis
-  destination:
-    server: https://kubernetes.default.svc
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: false
-  # ignoreDifferences:
-  #   - kind: Secret
-  #     name: prod-rabbitmq
-  #     jqPathExpressions:
-  #       - '.data'
-  #       - '.metadata.annotations.clone'
-  #       - '.metadata.labels'
-  sources:
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
-    path: resources/atlantis
-

applications/atlantis-resources.yaml

@@ -1,41 +0,0 @@
-# Currently not in use. Configured via the create-vcluster script.
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: atlantis-resources
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        autoSync: false
-        prune: false
-      # - cluster: https://staging-vcluster.staging-vcluster
-      #   env: staging
-      #   autoSync: false
-      #   prune: false
-  template:
-    metadata:
-      name: "{{ .env }}-atlantis-resources"
-    spec:
-      project: aux
-      syncPolicy:
-        automated: {}
-      destination:
-        server: "{{ .cluster }}"
-        namespace: atlantis
-      sources: {}
-      # - repoURL: https://gitlab.com/oceanbox/manifests.git
-      #   targetRevision: main
-      #   path: 'resources/atlantis/manifests/{{ env }}'
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/atlantis.yaml

@@ -1,47 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: atlantis
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: atlantis.srv.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-        hostname: atlantis.beta.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: '{{ .env }}-atlantis'
-    spec:
-      project: atlantis
-      destination:
-        namespace: atlantis
-        server: '{{ .cluster }}'
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/atlantis
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ .env }}'
-          - name: hostname
-            string: '{{ .hostname }}'
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/busynix.yaml

@@ -1,34 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: busynix
-  namespace: argocd
-spec:
-  generators:
-  - list:
-      elements:
-      # - cluster: https://kubernetes.default.svc
-      #   env: prod
-      #   hostname: busynix.srv.oceanbox.io
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-        hostname: busynix.beta.oceanbox.io
-  template:
-    metadata:
-      name: '{{ env }}-busynix'
-    spec:
-      project: aux
-      destination:
-        namespace: default
-        server: '{{ cluster }}'
-      source:
-        repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/busynix
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ env }}'
-          - name: hostname
-            string: '{{ hostname }}'

applications/cerbos.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: cerbos
-  namespace: argocd
-spec:
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-  template:
-    metadata:
-      name: '{{ env }}-cerbos'
-    spec:
-      project: aux
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: idp
-      sources:
-        - repoURL: https://download.cerbos.dev/helm-charts
-          targetRevision: 0.33.0
-          chart: cerbos
-          helm:
-            valueFiles:
-              - $values/kustomizations/cerbos/values.yaml
-              - $values/kustomizations/cerbos/values-{{ env }}.yaml
-        - repoURL: https://gitlab.com/oceanbox/manifests.git
-          targetRevision: main
-          ref: values

applications/dex.yaml

@@ -1,15 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: dex
-  namespace: argocd
-spec:
-  project: aux
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: idp
-  source:
-    repoURL: https://gitlab.com/oceanbox/manifests.git
-    targetRevision: main
-    path: kustomizations/dex/manifests
-

applications/geoserver.yaml

@@ -1,38 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: geoserver
-  namespace: argocd
-spec:
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: geoserver.srv.oceanbox.io
-      # - cluster: https://kubernetes.default.svc
-      #   env: staging
-      #   hostname: geoserver.beta.oceanbox.io
-  template:
-    metadata:
-      name: '{{ env }}-geoserver'
-    spec:
-      project: aux
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: geoserver
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/geoserver
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ env }}'
-          - name: hostname
-            string: geoserver.srv.oceanbox.io
-          - name: flags
-            string: "--skip-tests"
-          - name: chart
-            string: ncsa/geoserver

applications/hipster.yaml

@@ -1,47 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: hipster
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: hipster.srv.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-        hostname: hipster.beta.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: '{{ .env }}-hipster'
-    spec:
-      project: atlantis
-      destination:
-        namespace: atlantis
-        server: '{{ .cluster }}'
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/hipster
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ .env }}'
-          - name: hostname
-            string: '{{ .hostname }}'
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/openfga.yaml

@@ -1,47 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: openfga
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: openfga.adm.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://kubernetes.default.svc
-        env: staging
-        hostname: openfga.dev.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: '{{ .env }}-openfga'
-    spec:
-      project: aux
-      destination:
-        namespace: idp
-        server: '{{ .cluster }}'
-      sources:
-        - repoURL: https://openfga.github.io/helm-charts
-          targetRevision: 0.2.12
-          chart: openfga
-          helm:
-            valueFiles:
-              - $values/kustomizations/openfga/values.yaml
-              - $values/kustomizations/openfga/values-{{ .env }}.yaml
-        - repoURL: https://gitlab.com/oceanbox/manifests.git
-          targetRevision: main
-          ref: values
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/petimeter.yaml

@@ -1,50 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: petimeter
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-        hostname: petimeter.srv.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://staging-vcluster.staging-vcluster
-        env: staging
-        hostname: petimeter.beta.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: '{{ .env }}-petimeter'
-    spec:
-      project: atlantis
-      destination:
-        namespace: atlantis
-        server: '{{ .cluster }}'
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/petimeter
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ .env }}'
-          - name: hostname
-            string: '{{ .hostname }}'
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/petimeter/manifests
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

applications/redis.yaml

@@ -1,39 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: redis
-  namespace: argocd
-spec:
-  generators:
-  - list:
-      elements:
-      - cluster: https://kubernetes.default.svc
-        env: prod
-      - cluster: https://kubernetes.default.svc
-        env: staging
-  template:
-    metadata:
-      name: '{{ env }}-redis'
-    spec:
-      project: aux
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: redis
-      sources:
-        - repoURL: https://charts.bitnami.com/bitnami
-          targetRevision: 19.5.2
-          chart: redis
-          helm:
-            valueFiles:
-              - $values/kustomizations/redis/values-{{ env }}.yaml
-        - repoURL: https://gitlab.com/oceanbox/manifests.git
-          targetRevision: HEAD
-          ref: values
-        - repoURL: https://gitlab.com/oceanbox/manifests.git
-          targetRevision: main
-          path: kustomizations/redis/{{ env }}
-      ignoreDifferences:
-        - group: apps
-          kind: StatefulSet
-          jqPathExpressions:
-            - '.spec.template.spec.containers[].resources.limits.cpu'

applications/sorcerer.yaml

@@ -1,47 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: sorcerer
-  namespace: argocd
-spec:
-  goTemplate: true
-  generators:
-  - list:
-      elements:
-      - cluster: https://10.255.241.99:4443
-        env: prod
-        hostname: sorcerer.data.oceanbox.io
-        autoSync: false
-        prune: true
-      - cluster: https://10.255.241.99:4443
-        env: staging
-        hostname: sorcerer.ekman.oceanbox.io
-        autoSync: true
-        prune: true
-  template:
-    metadata:
-      name: '{{ .env }}-sorcerer'
-    spec:
-      project: atlantis
-      destination:
-        namespace: sorcerer
-        server: '{{ .cluster }}'
-      sources:
-      - repoURL: https://gitlab.com/oceanbox/manifests.git
-        targetRevision: main
-        path: kustomizations/sorcerer
-        plugin:
-          name: kustomize-helm-with-rewrite
-          parameters:
-          - name: env
-            string: '{{ .env }}'
-          - name: hostname
-            string: '{{ .hostname }}'
-  templatePatch: |
-    {{- if .autoSync }}
-    spec:
-      syncPolicy:
-        automated:
-          prune: {{ .prune }}
-          selfHeal: false
-    {{- end }}

attic/.helmignore

@@ -0,0 +1,26 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+*.nix
+old/
+nix/

attic/Chart.yaml

@@ -0,0 +1,27 @@
+apiVersion: v2
+name: sys
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
+dependencies: # A list of the chart requirements (optional)
+  - name: sys-cilium-policies
+    condition: cilium.enabled

attic/charts/cilium/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

attic/charts/cilium/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: cilium
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-applicationset-ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-applicationset-ingress
+  namespace: argocd
+spec:
+  description: Allow access from the ingress controller
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: applicationset-controller
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-notifications.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-argo-notifications
+  namespace: argocd
+spec:
+  description: Allow access to the ArgoCD Notifications
+  egress:
+    - toFQDNs:
+        - matchName: slack.com
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: notifications-controller

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-repo-access-applicationset.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-argo-repo-access-applicationset
+  namespace: argocd
+spec:
+  description: Allow access to the ArgoCD repo Applicationset
+  egress:
+    - toEntities:
+        - world
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: applicationset-controller

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-argo-repo-access.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-argo-repo-access
+  namespace: argocd
+spec:
+  description: Allow access to the ArgoCD repo server
+  egress:
+    - toEntities:
+        - world
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: repo-server

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-chartmuseum-ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-chartmuseum-ingress
+  namespace: argocd
+spec:
+  description: Allow access to the chartmuseum ingress
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: chartmuseum
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-image-updater-repo-access.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-image-updater-repo-access
+  namespace: argocd
+spec:
+  description: Allow argoCD image updater to access github container registry
+  egress:
+    - toFQDNs:
+        - matchName: ghcr.io
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-image-updater

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-ingress
+  namespace: argocd
+spec:
+  description: Allow access from the ingress controller
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: argocd
+spec:
+  description: Allow access to the Kube API server
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-microsoft-sso.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-microsoft-sso
+  namespace: argocd
+spec:
+  description: Allow argoCD dex server to authenticate to microsoft online azure oatuh
+  egress:
+    - toFQDNs:
+        - matchName: login.microsoftonline.com
+        - matchPattern: '*.microsoftonline.com'
+        - matchName: github.com
+        - matchName: api.github.com
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-dex-server

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics-rollout.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics-rollout
+  namespace: argocd
+spec:
+  description: Allow access to the Prometheus metrics
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: argo-rollouts
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "8090"
+              protocol: TCP

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics-workflows.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics-workflows
+  namespace: argocd
+spec:
+  description: Allow access to the Prometheus metrics
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: argo-workflows
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP

attic/charts/cilium/templates/argocd/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,30 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: argocd
+spec:
+  description: Allow access to the Prometheus metrics
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: argocd
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "8082"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "9001"
+              protocol: TCP
+            - port: "9121"
+              protocol: TCP
+            - port: "8084"
+              protocol: TCP
+            - port: "8083"
+              protocol: TCP
+            - port: "5558"
+              protocol: TCP

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-api-server-to-cert-manager.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server-to-cert-manager
+  namespace: cert-manager
+spec:
+  description: Allow the API server to communicate with the cert-manager pods
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: cert-manager
+spec:
+  description: Allow the Kube API server to communicate with cert-manager
+  egress:
+    - toEntities:
+        - kube-apiserver
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: cert-manager
+spec:
+  description: Allow Prometheus metrics
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "9402"
+              protocol: TCP

attic/charts/cilium/templates/cert-manager/CiliumNetworkPolicy-allow-world-traffic.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-traffic
+  namespace: cert-manager
+spec:
+  description: Allow the world to communicate with cert-manager
+  egress:
+    - toEntities:
+        - world
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/cilium-spire/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: cilium-spire
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/cilium-spire/CiliumNetworkPolicy-allow-remote-node-to-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-server
+  namespace: cilium-spire
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "8081"
+              protocol: TCP

attic/charts/cilium/templates/cilium-test/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,22 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: cilium-test
+spec:
+  egress:
+    - toEndpoints:
+        - {}
+    - toEntities:
+        - cluster
+    - toEntities:
+        - remote-node
+    - toEntities:
+        - world
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - cluster
+    - fromEntities:
+        - world

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-acme-solvers.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-acme-solvers
+spec:
+  description: Policy for ingress for Acme Solvers.
+  endpointSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-dns.yaml

@@ -0,0 +1,24 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  description: 'description: Allow only dns traffic by default. Also acts as a deny-all policy'
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+        - rules:
+            dns:
+              - matchPattern: '*'
+  endpointSelector:
+    matchExpressions:
+      - key: io.kubernetes.pod.namespace
+        operator: NotIn
+        values:
+          - kube-system

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-mariadb-operator.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-mariadb-operator
+spec:
+  description: allow mariadb instances to be reached by operator
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: mariadb
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: mariadb-operator
+            io.kubernetes.pod.namespace: mariadb-operator
+      toPorts:
+        - ports:
+            - port: "3306"
+              protocol: TCP

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-allow-s3.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-s3-traffic
+spec:
+  description: Policy for egress for CNPG Backups.
+  egress:
+    - toFQDNs:
+      {{- range .Values.s3.hosts }}
+        - matchName: {{ . | quote }}
+      {{- end }}
+      {{- range .Values.s3.patterns }}
+        - matchPattern: {{ . | quote }}
+      {{- end }}
+    - toCIDR:
+      {{- range .Values.s3.cidr }}
+        - {{ . | quote }}
+      {{- end }}
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-cilium-health-checks.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: cilium-health-checks
+spec:
+  description: Health checks
+  egress:
+    - toEntities:
+        - remote-node
+  endpointSelector:
+    matchLabels:
+      reserved:health: ""
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/clusterwide/CiliumClusterwideNetworkPolicy-deny-all.yaml

@@ -0,0 +1,9 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: deny-all
+spec:
+  description: Deny all
+  egress: []
+  endpointSelector: {}
+  ingress: []

attic/charts/cilium/templates/cnpg/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: cnpg
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: postgres-operator

attic/charts/cilium/templates/cnpg/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: cnpg
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "9443"
+              protocol: TCP

attic/charts/cilium/templates/downscaler/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: kube-downscaler
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      application: downscaler-py-kube-downscaler

attic/charts/cilium/templates/downscaler/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: kube-downscaler
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "9443"
+              protocol: TCP

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+        - host
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-hubble-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-hubble-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toFQDNs:
+        - matchPattern: hubble.*.*.*
+        - matchPattern: hubble.*.*.*.*
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: ingress-nginx
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "9913"
+              protocol: TCP

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-s3-traffic.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-s3-traffic
+  namespace: ingress-nginx
+spec:
+  egress:
+    - toCIDR:
+        - 10.139.2.10/32
+    - toCIDR:
+        - 10.139.2.11/32
+    - toCIDR:
+        - 10.139.2.20/32
+    - toCIDR:
+        - 10.139.2.21/32
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx

attic/charts/cilium/templates/ingress-nginx/CiliumNetworkPolicy-allow-world-to-ingress-nginx.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-to-ingress-nginx
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx
+  ingress:
+    - fromEntities:
+        - world
+    - toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+            - port: "443"
+              protocol: TCP

attic/charts/cilium/templates/jaeger/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -4,12 +4,12 @@ metadata:
   name: allow-kube-api
   namespace: jaeger
 spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
   endpointSelector:
     matchLabels: {}
-  egress:
-  - toEntities:
-    - kube-apiserver
-    toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP

attic/charts/cilium/templates/jaeger/CiliumNetworkPolicy-allow-remote-node-to-jaeger.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-jaeger
+  namespace: jaeger
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: jaeger-operator
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/kafka/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: kafka
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: kafka-operator

attic/charts/cilium/templates/kafka/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: kafka
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "9443"
+              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-controller-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-controller-metrics
+  namespace: kube-system
+spec:
+  description: Allow Controller Metrics
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-controller-manager
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "10257"
+              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-csi-webhook.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-csi-webhook
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app: csi-snapshot-webhook
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-dns-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-dns-metrics
+  namespace: kube-system
+spec:
+  description: Allow DNS metrics
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "9153"
+              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-dns-world.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-dns-world
+  namespace: kube-system
+spec:
+  description: Allow DNS World
+  egress:
+    - toCIDR:
+        - 8.8.8.8/32
+        - 172.31.254.11/32
+        - 1.1.1.1/32
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: '*'
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: '*'
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-dns.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-dns
+  namespace: kube-system
+spec:
+  description: Allow DNS
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  ingress:
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-traffic
+  namespace: kube-system
+spec:
+  description: Allow Host Traffic
+  egress:
+    - toEntities:
+        - remote-node
+        - host
+        - kube-apiserver
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-hubble-ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-hubble-ingress
+  namespace: kube-system
+spec:
+  description: Allow Hubble ingress
+  endpointSelector:
+    matchLabels:
+      k8s-app: hubble-ui
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-hubble-oauth2-ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-hubble-oauth2-ingress
+  namespace: kube-system
+spec:
+  description: Allow Hubble OAuth2 ingress
+  endpointSelector:
+    matchLabels:
+      k8s-app: oauth2-proxy
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-hubble-relay-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-hubble-relay-metrics
+  namespace: kube-system
+spec:
+  description: Allow Hubble Relay Metrics
+  endpointSelector:
+    matchLabels:
+      k8s-app: hubble-relay
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "9966"
+              protocol: TCP

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-microsoft-sso.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-microsoft-sso
+  namespace: kube-system
+spec:
+  description: Allow Microsoft SSO
+  egress:
+    - toFQDNs:
+        - matchName: login.microsoftonline.com
+        - matchPattern: '*.microsoftonline.com'
+        - matchName: graph.microsoft.com
+  endpointSelector:
+    matchLabels:
+      k8s-app: oauth2-proxy

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-namespace-traffic.yaml

@@ -0,0 +1,26 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-namespace-traffic
+  namespace: kube-system
+spec:
+  description: Allow Namespace Traffic
+  egress:
+    - toEndpoints:
+        - {}
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+          rules:
+            dns:
+              - matchPattern: '*'
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - {}

attic/charts/cilium/templates/kube-system/CiliumNetworkPolicy-allow-proxy-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-proxy-metrics
+  namespace: kube-system
+spec:
+  description: Allow Proxy metrics
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-proxy
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "10249"
+              protocol: TCP

attic/charts/cilium/templates/kubelet-serving/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: kubelet-serving-cert-approver
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/kyverno/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: kyverno
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/kyverno/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: kyverno
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: kyverno
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+    - toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP

attic/charts/cilium/templates/kyverno/CiliumNetworkPolicy-allow-remote-node-to-kyverno.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-kyverno
+  namespace: kyverno
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: kyverno
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/loki/CiliumNetworkPolicy-allow-loki-backend-to-api-server.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-loki-backend-to-api-server
+  namespace: loki
+spec:
+  description: Promtail needs to reach kube-apiserver
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: backend
+      app.kubernetes.io/instance: loki

attic/charts/cilium/templates/loki/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: loki
+spec:
+  description: Allow Prometheus read and write
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: loki
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "3100"
+              protocol: TCP
+            - port: "3500"
+              protocol: TCP

attic/charts/cilium/templates/loki/CiliumNetworkPolicy-allow-promtail-to-api-server.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-promtail-to-api-server
+  namespace: loki
+spec:
+  description: Promtail needs to reach kube-apiserver
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: promtail

attic/charts/cilium/templates/loki/CiliumNetworkPolicy-allow-stats-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-stats-grafana
+  namespace: loki
+spec:
+  description: Allow stats
+  egress:
+    - toFQDNs:
+        - matchName: stats.grafana.org
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: loki

attic/charts/cilium/templates/mariadb-operator/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: mariadb-operator
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: mariadb-operator

attic/charts/cilium/templates/mariadb-operator/CiliumNetworkPolicy-allow-host-to-mariadb.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-to-mariadb
+  namespace: mariadb-operator
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: mariadb-operator
+  ingress:
+    - fromEntities:
+        - host

attic/charts/cilium/templates/mariadb-operator/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: mariadb-operator
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: mariadb-operator
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP

attic/charts/cilium/templates/mariadb-operator/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: mariadb-operator
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - kube-apiserver
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+            - port: "9443"
+              protocol: TCP

attic/charts/cilium/templates/mayastor/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-host-traffic
+  namespace: mayastor
+spec:
+  description: Allow Host Traffic
+  egress:
+    - toEntities:
+        - remote-node
+        - host
+        - kube-apiserver
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/mayastor/CiliumNetworkPolicy-allow-remote-node-to-agent-core.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-agent-core
+  namespace: mayastor
+spec:
+  description: Allow Remote to Agent Core
+  endpointSelector:
+    matchLabels:
+      app: agent-core
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/mayastor/CiliumNetworkPolicy-allow-remote-node-to-etcd.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-etcd
+  namespace: mayastor
+spec:
+  description: Allow Remote to Etcd
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: etcd
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/mayastor/CiliumNetworkPolicy-allow-remote-node-to-maya.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-to-maya
+  namespace: mayastor
+spec:
+  description: Allow Remote to Mayastor
+  endpointSelector:
+    matchLabels:
+      app: api-rest
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/minio-operator/CiliumClusterwideNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-kube-api
+spec:
+  description: Allow access to the Kube API server
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app: minio

attic/charts/cilium/templates/minio-operator/CiliumClusterwideNetworkPolicy-allow-minio-operator.yaml

@@ -0,0 +1,17 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-minio-operator
+spec:
+  description: Allow access to the Kube API server
+  endpointSelector:
+    matchLabels:
+      app: minio
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: minio-operator
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP

attic/charts/cilium/templates/minio-operator/CiliumClusterwideNetworkPolicy-allow-nodeport-ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-nodeport-ingress
+spec:
+  description: Allow access to the Kube API server
+  endpointSelector:
+    matchLabels:
+      app: minio
+  ingress:
+    - fromEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP

attic/charts/cilium/templates/minio-operator/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: minio-operator
+spec:
+  description: Allow access to the Kube API server
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/odigos-system/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: odigos-system
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}

attic/charts/cilium/templates/odigos-system/CiliumNetworkPolicy-allow-port-4317.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-port-4317
+  namespace: odigos-system
+spec:
+  egress:
+    - toPorts:
+        - ports:
+            - port: "4317"
+              protocol: TCP
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - remote-node

attic/charts/cilium/templates/one-password-operator/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: one-password
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: one-password-operator

attic/charts/cilium/templates/one-password-operator/CiliumNetworkPolicy-allow-remote-node-webhooks.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-remote-node-webhooks
+  namespace: one-password
+spec:
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEntities:
+        - kube-apiserver
+    - toPorts:
+        - ports:
+            - port: "9443"
+              protocol: TCP

attic/charts/cilium/templates/opencost/CiliumNetworkPolicy-allow-kube-api.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-kube-api
+  namespace: opencost
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: opencost

attic/charts/cilium/templates/otel/CiliumNetworkPolicy-allow-otel-collector-loadbalancer-ingress.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-otel-collector-loadbalancer-ingress
+  namespace: otel
+spec:
+  description: Allow ingress from world
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: opentelemetry-collector
+  ingress:
+    - fromEntities:
+        - world

attic/charts/cilium/templates/postfix/CiliumNetworkPolicy-allow-mail-egress.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-mail-egress
+  namespace: postfix
+spec:
+  description: Allow mailserver to send mails to world
+  egress:
+    - toEntities:
+        - world
+  endpointSelector:
+    matchLabels:
+      app: smtp-relay

attic/charts/cilium/templates/postfix/CiliumNetworkPolicy-allow-mail-ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-mail-ingress
+  namespace: postfix
+spec:
+  description: Allow all services in cluster to send mail
+  endpointSelector:
+    matchLabels:
+      app: smtp-relay
+  ingress:
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      toPorts:
+        - ports:
+            - port: "25"
+              protocol: TCP
+            - port: "587"
+              protocol: TCP

attic/charts/cilium/templates/postfix/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -0,0 +1,18 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus-metrics
+  namespace: postfix
+spec:
+  description: 'Allow prometheus metrics '
+  endpointSelector:
+    matchLabels:
+      app: smtp-relay
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "9154"
+              protocol: TCP