K3S-Cluster/home-cluster-ops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adding app cilium

Browse Source
This commit is contained in:
Edward Cheng
2024-06-09 12:58:27 +10:00
parent ac8a558262
commit 8482a12f62
14 changed files with 285 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
kubernetes/rpi5-cluster/apps/cilium/app/helmrelease.yaml Normal file
View File

@@ -0,0 +1,43 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
chart:
spec:
chart: cilium
version: 1.15.5
sourceRef:
kind: HelmRepository
namespace: kube-system
name: cilium
install:
crds: Create
upgrade:
crds: CreateReplace
interval: 1h
driftDetection:
mode: enabled
values:
global:
encryption:
enabled: true
nodeEncryption: true
policyEnforcementMode: default
operator:
replicas: 1
ipam:
mode: cluster-pool
operator:
clusterPoolIPv4PodCIDRList: [10.42.0.0/16]
clusterPoolIPv4MaskSize: 24
dnsProxy:
dnsRejectResponseCode: nameError
cni:
exclusive: false

8
kubernetes/rpi5-cluster/apps/cilium/app/helmrepository.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: cilium
namespace: kube-system
spec:
interval: 1h
url: https://helm.cilium.io

30
kubernetes/rpi5-cluster/apps/cilium/kustomization.yaml Normal file
View File

@@ -0,0 +1,30 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-app
namespace: kube-system
spec:
interval: 1h
targetNamespace: kube-system
path: ./kubernetes/rpi5-cluster/apps/cilium/app
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-networkpolicies
namespace: kube-system
spec:
interval: 1h
path: ./kubernetes/rpi5-cluster/apps/cilium/networkpolicies
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops
dependsOn:
- name: cilium-app

19
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kube-dns.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-kube-dns
spec:
endpointSelector:
matchExpressions:
- key: rpi5.cluster.policy/egress-kube-dns
operator: NotIn
values:
- "false"
egress:
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"

21
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-kubeapi.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-kubeapi
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-kubeapi: "true"
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "6443"
- toEntities:
- kube-apiserver
toPorts:
- ports:
- port: "443"
- port: "6443"

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-namespace.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-namespace
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-namespace: "true"
egress:
- toEndpoints:
- {}

12
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-nodes.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-nodes
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-nodes: "true"
egress:
- toEntities:
- host
- remote-node

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world-with-lan.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-world-with-lan
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-world-with-lan: "true"
egress:
- toCIDRSet:
- cidr: 0.0.0.0/0

15
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/egress-world.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-world
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-world: "true"
egress:
- toCIDRSet:
- cidr: 0.0.0.0/0
except:
- 192.168.1.0/24
- 192.168.2.0/24
- 100.64.0.0/10

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-namespace.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-namespace
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-namespace: "true"
ingress:
- fromEndpoints:
- {}

65
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nginx.yaml Normal file
View File

@@ -0,0 +1,65 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-ingress
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-ingress: "true"
ingress:
- fromEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: ingress-nginx
namespace: ingress-nginx
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
egress:
- toEndpoints:
- matchLabels:
rpi5.cluster.policy/ingress-ingress: "true"
matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: egress-ingress
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/egress-ingress: "true"
egress:
- toEndpoints:
- matchLabels:
io.kubernetes.pod.namespace: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: egress-nginx
namespace: ingress-nginx
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/component: controller
ingress:
- fromEndpoints:
- matchLabels:
rpi5.cluster.policy/egress-ingress: "true"
matchExpressions:
- key: io.kubernetes.pod.namespace
operator: Exists

12
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-nodes.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-nodes
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-nodes: "true"
ingress:
- fromEntities:
- host
- remote-node

11
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/ingress-world.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: ingress-world
spec:
endpointSelector:
matchLabels:
rpi5.cluster.policy/ingress-world: "true"
ingress:
- fromEntities:
- world

16
kubernetes/rpi5-cluster/apps/cilium/networkpolicies/local-path-provisioner.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: local-path-provisioner
namespace: kube-system
spec:
endpointSelector:
matchLabels:
app: local-path-provisioner
egress:
- toEntities:
- host
- remote-node
toPorts:
- ports:
- port: "6443"