commit baba052b280e36796c63fd30987c62a86bdf2e31 parent f633e25544dd3d4dea06b6b88e6f8b217f3888aa Author: MTRNord <mtrnord1@gmail.com> Date: Wed, 12 Feb 2025 09:54:08 +0100 try network policy for matrix Diffstat:
| M | apps/2024_cluster/kustomization.yaml | | | 1 | + |
| A | apps/base/matrix/networkpolicies/kustomization.yaml | | | 5 | +++++ |
| A | apps/base/matrix/networkpolicies/matrix.yaml | | | 104 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
3 files changed, 110 insertions(+), 0 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml @@ -42,3 +42,4 @@ resources: #- ../base/vault # No arm images for rundeck :| #- ../base/rundeck + - ../base/matrix/networkpolicies diff --git a/apps/base/matrix/networkpolicies/kustomization.yaml b/apps/base/matrix/networkpolicies/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: matrix +resources: + - matrix.yaml diff --git a/apps/base/matrix/networkpolicies/matrix.yaml b/apps/base/matrix/networkpolicies/matrix.yaml @@ -0,0 +1,104 @@ +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: matrix + namespace: matrix +spec: + endpointSelector: {} + egress: + - toEndpoints: + - matchLabels: + io.kubernetes.pod.namespace: kube-system + k8s-app: kube-dns + toPorts: + - ports: + - port: "53" + protocol: UDP + rules: + dns: + - matchPattern: "*" + - toEndpoints: + - matchLabels: + k8s:app.kubernetes.io/component: proxy + k8s:app.kubernetes.io/managed-by: envoy-gateway + k8s:app.kubernetes.io/name: envoy + k8s:gateway.envoyproxy.io/owning-gateway-name: envoy-gateway + k8s:gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: envoy-gateway + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: envoy-gateway + toPorts: + - ports: + - port: "10443" + - toEndpoints: + - matchLabels: + k8s:app.kubernetes.io/component: synapse + k8s:app.kubernetes.io/instance: matrix-synapse + k8s:app.kubernetes.io/name: matrix-synapse + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: matrix + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: matrix + toPorts: + - ports: + - port: "9093" + - toEndpoints: + - matchLabels: + k8s:app: draupnir-synapse-keydb + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: matrix + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: matrix + toPorts: + - ports: + - port: "6379" + - toEndpoints: + - matchLabels: + k8s:app: matrix-synapse-keydb + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: matrix + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: matrix + toPorts: + - ports: + - port: "6379" + - toEndpoints: + - matchLabels: + k8s:app: pantalaimon-freifunk + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: matrix + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: matrix + toPorts: + - ports: + - port: "8008" + - toEndpoints: + - matchLabels: + k8s:cnpg.io/cluster: pg-cluster-v2 + k8s:cnpg.io/instanceName: pg-cluster-v2-6 + k8s:cnpg.io/instanceRole: primary + k8s:cnpg.io/podRole: instance + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: postgres-cluster + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: infra-configs + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: postgres-cluster + k8s:role: primary + toPorts: + - ports: + - port: "5432" + - toEndpoints: + - matchLabels: + k8s:app.kubernetes.io/instance: traefik + k8s:app.kubernetes.io/managed-by: Helm + k8s:app.kubernetes.io/name: traefik + k8s:helm.sh/chart: traefik-34.3.0 + k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name: traefik-ingress + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/name: apps-namespaces + k8s:io.cilium.k8s.namespace.labels.kustomize.toolkit.fluxcd.io/namespace: flux-system + k8s:io.kubernetes.pod.namespace: traefik-ingress + toPorts: + - ports: + - port: "8443" + - toEntities: + - world