Merge branch 'main' of https://github.com/3dwardch3ng/home-cluster-ops

kubernetes/rpi5-cluster/apps/cilium/app/helmrelease.yaml

@@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cilium
-  namespace: kube-system
-spec:
-  chart:
-    spec:
-      chart: cilium
-      version: 1.15.5
-      sourceRef:
-        kind: HelmRepository
-        namespace: kube-system
-        name: cilium
-  install:
-    crds: Create
-  upgrade:
-    crds: CreateReplace
-  interval: 1h
-  driftDetection:
-    mode: enabled
-  values:
-    global:
-      encryption:
-        enabled: true
-        nodeEncryption: true
-
-    policyEnforcementMode: default
-
-    operator:
-      replicas: 1
-
-    ipam:
-      mode: cluster-pool
-      operator:
-        clusterPoolIPv4PodCIDRList: [10.42.0.0/16]
-        clusterPoolIPv4MaskSize: 24
-
-    dnsProxy:
-      dnsRejectResponseCode: nameError
-
-    cni:
-      exclusive: false

kubernetes/rpi5-cluster/apps/cilium/app/helmrepository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cilium
-  namespace: kube-system
-spec:
-  interval: 1h
-  url: https://helm.cilium.io

kubernetes/rpi5-cluster/apps/cilium/ks.yaml

@@ -1,15 +1,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cilium-app
+  name: cilium-networkpolicies
   namespace: kube-system
 spec:
   interval: 1h
-  targetNamespace: kube-system
+  path: ./kubernetes/rpi5-cluster/apps/cilium/networkpolicies
-  path: ./kubernetes/rpi5-cluster/apps/cilium/app
   prune: true
   sourceRef:
     kind: GitRepository
     namespace: flux-system
     name: home-cluster-ops
-

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/coredns.yaml

@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: coredns
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "53"
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kube-dns.yaml

@@ -0,0 +1,19 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-kube-dns
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: rpi5.cluster.policy/egress-kube-dns
+        operator: NotIn
+        values:
+          - "false"
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kubeapi.yaml

@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-kubeapi
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-kubeapi: "true"
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "443"
+            - port: "6443"

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-namespace.yaml

@@ -0,0 +1,11 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-namespace
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-namespace: "true"
+  egress:
+    - toEndpoints:
+        - {}

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-nodes.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-nodes
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-nodes: "true"
+  egress:
+    - toEntities:
+        - host
+        - remote-node

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world-with-lan.yaml

@@ -0,0 +1,11 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-world-with-lan
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-world-with-lan: "true"
+  egress:
+    - toCIDRSet:
+        - cidr: 0.0.0.0/0

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world.yaml

@@ -0,0 +1,15 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-world
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-world: "true"
+  egress:
+    - toCIDRSet:
+        - cidr: 0.0.0.0/0
+          except:
+            - 192.168.1.0/24
+            - 192.168.2.0/24
+            - 100.64.0.0/10

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-namespace.yaml

@@ -0,0 +1,11 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-namespace
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-namespace: "true"
+  ingress:
+    - fromEndpoints:
+        - {}

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nginx.yaml

@@ -0,0 +1,65 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-ingress: "true"
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx
+            app.kubernetes.io/name: ingress-nginx
+            app.kubernetes.io/component: controller
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/component: controller
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            rpi5.cluster.policy/ingress-ingress: "true"
+          matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: egress-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/egress-ingress: "true"
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ingress-nginx
+            app.kubernetes.io/name: ingress-nginx
+            app.kubernetes.io/component: controller
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: egress-nginx
+  namespace: ingress-nginx
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/component: controller
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            rpi5.cluster.policy/egress-ingress: "true"
+          matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nodes.yaml

@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-nodes
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-nodes: "true"
+  ingress:
+    - fromEntities:
+        - host
+        - remote-node

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-world.yaml

@@ -0,0 +1,11 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: ingress-world
+spec:
+  endpointSelector:
+    matchLabels:
+      rpi5.cluster.policy/ingress-world: "true"
+  ingress:
+    - fromEntities:
+      - world

kubernetes/rpi5-cluster/apps/cilium/networkpolicies/local-path-provisioner.yaml

@@ -0,0 +1,16 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: local-path-provisioner
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app: local-path-provisioner
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "6443"