Merge pull request #46 from 3dwardch3ng/infra/cilium

Infra/cilium

kubernetes/apps/kustomization.yaml

@@ -3,5 +3,4 @@ kind: Kustomization
 resources:
   - ./capacitor/capacitor.yaml
   - ./cert-manager/cert-manager.yaml
-  - ./cilium/cilium.yaml
   - ./podinfo/podinfo.yaml

kubernetes/infrastructure/cilium/app/release.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: cilium
+      version: 1.15.5
+      sourceRef:
+        kind: HelmRepository
+        namespace: kube-system
+        name: cilium
+  install:
+    crds: Create
+  upgrade:
+    crds: CreateReplace
+  interval: 1h
+  driftDetection:
+    mode: enabled
+  values:
+    global:
+      encryption:
+        enabled: true
+        nodeEncryption: true
+
+    policyEnforcementMode: default
+
+    operator:
+      replicas: 1
+
+    ipam:
+      mode: cluster-pool
+      operator:
+        clusterPoolIPv4PodCIDRList: [10.42.0.0/16]
+        clusterPoolIPv4MaskSize: 24
+
+    dnsProxy:
+      dnsRejectResponseCode: nameError
+
+    cni:
+      exclusive: false

kubernetes/infrastructure/cilium/app/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  interval: 1h
+  url: https://helm.cilium.io

kubernetes/infrastructure/cilium/cilium.yaml

@@ -1,11 +1,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cilium-networkpolicies
+  name: cilium
   namespace: kube-system
 spec:
   interval: 1h
-  path: ./kubernetes/apps/cilium/networkpolicies
+  path: ./kubernetes/infrastructure/cilium
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/infrastructure/cilium/networkpolicies/egress-kube-dns.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-kube-dns
+  namespace: kube-system
 spec:
   endpointSelector:
     matchExpressions:

kubernetes/infrastructure/cilium/networkpolicies/egress-kubeapi.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-kubeapi
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/egress-namespace.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-namespace
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/egress-nodes.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-nodes
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/egress-world-with-lan.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-world-with-lan
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/egress-world.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-world
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/ingress-namespace.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: ingress-namespace
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/ingress-nginx.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: ingress-ingress
+  namespace: ingress-nginx
 spec:
   endpointSelector:
     matchLabels:
@@ -35,6 +36,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: egress-ingress
+  namespace: ingress-nginx
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/ingress-nodes.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: ingress-nodes
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/cilium/networkpolicies/ingress-world.yaml

@@ -2,6 +2,7 @@ apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: ingress-world
+  namespace: kube-system
 spec:
   endpointSelector:
     matchLabels:

kubernetes/infrastructure/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./repositories/repositories.yaml
+  - ./cilium/cilium.yaml