chore(apps): Add network policies to apps

2026-10-28 15:19:35 +05:30
parent 6e1f53ed3f
commit 49ee2a29f5
20 changed files with 404 additions and 0 deletions
@@ -15,6 +15,9 @@ spec:
    - chart: traefik
      helm:
        values: |
+          # The network policy allows no internet egress
+          global:
+            checkNewVersion: false
          # Query strings are dropped, as OAuth callbacks carry codes.
          accessLog:
            enabled: true
@@ -30,6 +30,28 @@ spec:
              enabled: true
              type: hostPath
              hostPath: /srv/media
+          # Metadata, artwork, and subtitles come from the internet; the
+          # cluster and the LAN stay off limits
+          networkPolicy:
+            enabled: true
+            ingress:
+              allowExternal: false
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: traefik
+            egress:
+              allowAllEgress: false
+              restrictedEgress:
+                allowMetadata: false
+                allowInCluster: false
+              customRules:
+                - to:
+                    - ipBlock:
+                        cidr: 0.0.0.0/0
+                        except:
+                          - 10.0.0.0/8
+                          - 172.16.0.0/12
+                          - 192.168.0.0/16
          resources:
            limits:
              cpu: 3000m