work in progress. working on pod templatest.

2025-01-02 17:14:06 +01:00
parent 8c5a099082
commit 207043d38f
15 changed files with 419 additions and 91 deletions
@@ -0,0 +1,26 @@
+kind: CiliumNetworkPolicy
+apiVersion: cilium.io/v2
+metadata:
+  name: {{.name}}
+  namespace: {{.namespace}}
+  labels: "{{ .labels | toYaml | nindent 4 }}"
+spec:
+  endpointSelector:
+    {{ .selector }}
+  {{- if .from }}
+  ingress:
+  - fromEntities:
+    - kube-apiserver
+    # See https://github.com/cilium/cilium/issues/35401
+    - remote-node
+  {{- end }}
+  {{- if .to }}
+  egress:
+  - toEntities:
+      - kube-apiserver
+  - toPorts:
+      - ports:
+          - port: "6443"
+            protocol: TCP
+  {{- end }}
+
@@ -0,0 +1,56 @@
+---
+{{- define "peer" }}
+      - podSelector:
+          matchLabels: {{ .MatchLabels | toYaml | nindent 12 }}
+        namespaceSelector:
+          matchLabels:
+            kubernetes.io/metadata.name: {{ .Namespace }}
+        {{- if .Ports }}
+        ports:
+          # TODO: add protocol
+          {{- range $port := .Ports }}
+          - port: {{ $port }}
+          {{- end }}
+        {{- end }}
+{{- end }}
+-
+  {{- define "ports" }}
+    {{- range $port := . }}
+    PORT {{ $port }}
+    {{- end }}
+  {{- end }}
+
+
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: "{{.app.Name}}"
+  namespace: "{{.app.Namespace}}"
+  labels: {{ .labels | toYaml | nindent 4 }}
+spec:
+  podSelector: {{ .app.MatchLabels | toYaml | nindent 4 }}
+  policyTypes:
+    {{- if or .ingress.Applications .ingress.Networks }}
+    - Ingress
+    {{- end }}
+    {{- if or .egress.Applications .egress.Networks }}
+    - Egress
+    {{- end }}
+
+  {{- if or .ingress.Applications .ingress.Networks }}
+  ingress:
+    from:
+      {{- range $ingress := .ingress.Applications }}
+        {{- template "peer" $ingress }}
+        {{- template "ports" $ingress.Ports }}
+      {{- end }}
+      {{- range $ingress := .ingress.Networks }}
+      - ipBlock:
+          cidr: {{ $ingress.CIDR}}
+          except:
+          {{- range $except := $ingress.Except }}
+          - {{ $except }}
+          {{- end }}
+      {{- end }}
+  {{- end }}
+    THEEND