whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(apps): Add network policies to apps

Browse Source
This commit is contained in:
whyredfire
2026-10-28 15:19:35 +05:30
parent 6e1f53ed3f
commit 49ee2a29f5
20 changed files with 404 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
add-ons/authentik/kustomization.yaml
+1
View File
@@ -12,3 +12,4 @@ resources:
- blueprint-wireguard-admin.yaml - blueprint-wireguard-admin.yaml
- httproute.yaml - httproute.yaml
- referencegrant.yaml - referencegrant.yaml
- networkpolicy.yaml
add-ons/authentik/networkpolicy.yaml
+57
View File
@@ -0,0 +1,57 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: authentik
namespace: authentik
spec:
egress:
- to:
- podSelector: {}
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 5432
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: postgres
podSelector:
matchLabels:
cnpg.io/cluster: postgres
- ports:
- port: 6443
protocol: TCP
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- podSelector: {}
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 9000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
policyTypes:
- Ingress
- Egress
add-ons/postgres/kustomization.yaml
+1
View File
@@ -9,3 +9,4 @@ resources:
- pgweb-db-sealedsecret.yaml - pgweb-db-sealedsecret.yaml
- redoost-db-sealedsecret.yaml - redoost-db-sealedsecret.yaml
- redoost-database.yaml - redoost-database.yaml
- networkpolicy.yaml
add-ons/postgres/networkpolicy.yaml
+72
View File
@@ -0,0 +1,72 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: postgres
namespace: postgres
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
ingress:
- from:
- podSelector:
matchLabels:
cnpg.io/cluster: postgres
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: cnpg-system
podSelector:
matchLabels:
app.kubernetes.io/name: cloudnative-pg
ports:
- port: 8000
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: authentik
podSelector:
matchLabels:
app.kubernetes.io/name: authentik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: grafana
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: pgweb
podSelector:
matchLabels:
app.kubernetes.io/name: pgweb
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 5432
protocol: TCP
podSelector:
matchLabels:
cnpg.io/cluster: postgres
policyTypes:
- Ingress
- Egress
add-ons/traefik/kustomization.yaml
+1
View File
@@ -3,3 +3,4 @@ kind: Kustomization
resources: resources:
- wildcard-whyredfire-dev.yaml - wildcard-whyredfire-dev.yaml
- wildcard-whyredfire-dpdns-org.yaml - wildcard-whyredfire-dpdns-org.yaml
- networkpolicy.yaml
add-ons/traefik/networkpolicy.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: traefik
namespace: traefik
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 6443
protocol: TCP
- to:
- namespaceSelector: {}
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 8000
protocol: TCP
- port: 8443
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: traefik
policyTypes:
- Ingress
- Egress
apps/bentopdf/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- deployment.yaml - deployment.yaml
- service.yaml - service.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/bentopdf/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: bentopdf
namespace: bentopdf
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: bentopdf
policyTypes:
- Ingress
- Egress
apps/garage-ui/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- sealed-secret.yaml - sealed-secret.yaml
- middleware.yaml - middleware.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/garage-ui/networkpolicy.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage-ui
namespace: garage
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 3903
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
policyTypes:
- Ingress
- Egress
apps/garage/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- httproute-s3.yaml - httproute-s3.yaml
- sealed-secret.yaml - sealed-secret.yaml
- service-admin.yaml - service-admin.yaml
- networkpolicy.yaml
apps/garage/networkpolicy.yaml
+44
View File
@@ -0,0 +1,44 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage
namespace: garage
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: monitoring
podSelector:
matchLabels:
app.kubernetes.io/name: loki
ports:
- port: 3900
protocol: TCP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: redoost
ports:
- port: 3902
protocol: TCP
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
ports:
- port: 3903
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage
policyTypes:
- Ingress
- Egress
apps/qbit/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml - service.yaml
- middleware.yaml - middleware.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/qbit/networkpolicy.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: qbittorrent
namespace: qbit
spec:
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
policyTypes:
- Ingress
- Egress
apps/rustbin/kustomization.yaml
+1
View File
@@ -5,3 +5,4 @@ resources:
- deployment.yaml - deployment.yaml
- service.yaml - service.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/rustbin/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rustbin
namespace: rustbin
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 3000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: rustbin
policyTypes:
- Ingress
- Egress
apps/wireguard/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml - service.yaml
- service-admin.yaml - service-admin.yaml
- httproute.yaml - httproute.yaml
- networkpolicy.yaml
apps/wireguard/networkpolicy.yaml
+48
View File
@@ -0,0 +1,48 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: wireguard
namespace: wireguard
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- to:
- ipBlock:
cidr: 192.168.2.0/24
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 27299
protocol: UDP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 51821
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: wireguard
policyTypes:
- Ingress
- Egress
argocd-apps/add-ons/traefik.yaml
+3
View File
@@ -15,6 +15,9 @@ spec:
- chart: traefik - chart: traefik
helm: helm:
values: | values: |
# The network policy allows no internet egress
global:
checkNewVersion: false
# Query strings are dropped, as OAuth callbacks carry codes. # Query strings are dropped, as OAuth callbacks carry codes.
accessLog: accessLog:
enabled: true enabled: true
argocd-apps/apps/jellyfin.yaml
+22
View File
@@ -30,6 +30,28 @@ spec:
enabled: true enabled: true
type: hostPath type: hostPath
hostPath: /srv/media hostPath: /srv/media
# Metadata, artwork, and subtitles come from the internet; the
# cluster and the LAN stay off limits
networkPolicy:
enabled: true
ingress:
allowExternal: false
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
egress:
allowAllEgress: false
restrictedEgress:
allowMetadata: false
allowInCluster: false
customRules:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
resources: resources:
limits: limits:
cpu: 3000m cpu: 3000m