manifests/charts/vcluster/templates/kyverno-policies/allow-vcluster-apiserver.yaml

{{- $fullname := include "vCluster.fullname" . -}}
{{- $name := include "vCluster.releaseName" . -}}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    kyverno.io/kyverno-version: 1.7.0
    policies.kyverno.io/description:  Allow egress to vcluster kube-apiserver
    policies.kyverno.io/minversion: 1.7.0
    policies.kyverno.io/subject: Namespace, NetworkPolicy
    policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
  name: allow-{{ $name }}-vcluster-apiserver
  namespace: {{ .Release.Namespace }}
spec:
  background: true
  generateExisting: true
  rules:
  - name: allow-{{ $name }}-vcluster-apiserver
    generate:
      apiVersion: cilium.io/v2
      kind: CiliumNetworkPolicy
      name: allow-{{ $name }}-vcluster-apiserver-access
      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
      synchronize: true
      data:
        spec:
          description: Allow egress to vcluster kube-apiserver
          egress:
          - toEndpoints:
            - matchLabels:
               app: vcluster
            toPorts:
            - ports:
              - port: "443"
                protocol: TCP
          endpointSelector: {}
    match:
      any:
      - resources:
          kinds:
          - Namespace
          names:
          - {{ $fullname }}
      - resources:
          kinds:
          - Namespace
          selector:
            matchLabels:
              vcluster.loft.sh/vcluster-name: {{ $fullname }}