whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(apps): Add network policies to apps

Browse Source
This commit is contained in:
whyredfire
2026-10-28 15:19:35 +05:30
parent 6e1f53ed3f
commit 49ee2a29f5
20 changed files with 404 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
add-ons/authentik/kustomization.yaml
+1
View File
@@ -12,3 +12,4 @@ resources:
- blueprint-wireguard-admin.yaml
- httproute.yaml
- referencegrant.yaml
- networkpolicy.yaml
add-ons/authentik/networkpolicy.yaml
+57
View File
@@ -0,0 +1,57 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: authentik
namespace: authentik
spec:
egress:
- to:
- podSelector: {}
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 5432
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: postgres
podSelector:
matchLabels:
cnpg.io/cluster: postgres
- ports:
- port: 6443
protocol: TCP
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- podSelector: {}
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 9000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
policyTypes:
- Ingress
- Egress
add-ons/postgres/kustomization.yaml
+1
View File
@@ -9,3 +9,4 @@ resources:
- pgweb-db-sealedsecret.yaml
- redoost-db-sealedsecret.yaml
- redoost-database.yaml
- networkpolicy.yaml
add-ons/postgres/networkpolicy.yaml
+72
View File
@@ -0,0 +1,72 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: postgres
namespace: postgres
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
ingress:
- from:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: cnpg-system
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
ports:
- port: 8000
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: authentik
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: grafana
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: pgweb
podSelector:
matchLabels:
app.kubernetes.io/name: pgweb
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 5432
protocol: TCP
podSelector:
matchLabels:
cnpg.io/cluster: postgres
policyTypes:
- Ingress
- Egress
add-ons/traefik/kustomization.yaml
+1
View File
@@ -3,3 +3,4 @@ kind: Kustomization
resources:
- wildcard-whyredfire-dev.yaml
- wildcard-whyredfire-dpdns-org.yaml
- networkpolicy.yaml
add-ons/traefik/networkpolicy.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: traefik
namespace: traefik
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- namespaceSelector: {}
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
- Egress