work in progress. working on pod templatest.

2025-01-02 17:14:06 +01:00
parent 8c5a099082
commit 207043d38f
15 changed files with 419 additions and 91 deletions
@@ -1,15 +0,0 @@
-kind: CiliumNetworkPolicy
-apiVersion: cilium.io/v2
-metadata:
-  name: {{.name}}
-  namespace: {{.namespace}}
-spec:
-  endpointSelector:
-    {{ .selector }}
-  egress:
-  - toEntities:
-    - kube-apiserver
-  - toPorts:
-    - ports:
-      - port: "6443"
-        protocol: TCP
@@ -1,14 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: "{{.name}}"
-  namespace: "{{.namespace}}"
-spec:
-  policyTypes:
-  - Egress
-  podSelector:
-    {{.selector}}
-  egress:
-    {{- range $from := .from }}
-    - {{ $from | nindent 4 }}
-    {{- end }}
@@ -1,14 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: "{{.name}}"
-  namespace: "{{.namespace}}"
-spec:
-  policyTypes:
-    - Ingress
-  podSelector:
-    {{.selector}}
-  ingress:
-    {{- range $from := .from }}
-    - {{ $from | nindent 4 }}
-    {{- end }}
@@ -0,0 +1,6 @@
+---
+####################################################################################
+# LINKERD NETPOL TBD
+####################################################################################
+
+
@@ -0,0 +1,14 @@
+
+{{- if not .Open }}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: default-allow-nothing
+  namespace: "{{.Name}}"
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+{{ end }}
@@ -3,11 +3,24 @@ apiVersion: cilium.io/v2
 metadata:
  name: {{.name}}
  namespace: {{.namespace}}
+  labels: "{{ .labels | toYaml | nindent 4 }}"
 spec:
  endpointSelector:
    {{ .selector }}
+  {{- if .from }}
  ingress:
  - fromEntities:
    - kube-apiserver
    # See https://github.com/cilium/cilium/issues/35401
    - remote-node
+  {{- end }}
+  {{- if .to }}
+  egress:
+  - toEntities:
+      - kube-apiserver
+  - toPorts:
+      - ports:
+          - port: "6443"
+            protocol: TCP
+  {{- end }}
+
@@ -0,0 +1,56 @@
+---
+{{- define "peer" }}
+      - podSelector:
+          matchLabels: {{ .MatchLabels | toYaml | nindent 12 }}
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Namespace }}
+        {{- if .Ports }}
+        ports:
+          # TODO: add protocol
+          {{- range $port := .Ports }}
+          - port: {{ $port }}
+          {{- end }}
+        {{- end }}
+{{- end }}
+-
+  {{- define "ports" }}
+    {{- range $port := . }}
+    PORT {{ $port }}
+    {{- end }}
+  {{- end }}
+
+
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: "{{.app.Name}}"
+  namespace: "{{.app.Namespace}}"
+  labels: {{ .labels | toYaml | nindent 4 }}
+spec:
+  podSelector: {{ .app.MatchLabels | toYaml | nindent 4 }}
+  policyTypes:
+    {{- if or .ingress.Applications .ingress.Networks }}
+    - Ingress
+    {{- end }}
+    {{- if or .egress.Applications .egress.Networks }}
+    - Egress
+    {{- end }}
+
+  {{- if or .ingress.Applications .ingress.Networks }}
+  ingress:
+    from:
+      {{- range $ingress := .ingress.Applications }}
+        {{- template "peer" $ingress }}
+        {{- template "ports" $ingress.Ports }}
+      {{- end }}
+      {{- range $ingress := .ingress.Networks }}
+      - ipBlock:
+          cidr: {{ $ingress.CIDR}}
+          except:
+          {{- range $except := $ingress.Except }}
+          - {{ $except }}
+          {{- end }}
+      {{- end }}
+  {{- end }}
+    THEEND