gwg313/homelab-gitops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove unneeded network policies from apps

Browse source 
Signed-off-by: gwg313 <gwg313@pm.me>
This commit is contained in:
gwg313 2026-05-17 22:58:17 -04:00
parent 90d5ce565a
commit 322ba29302
Signed by: gwg313
GPG key ID: 60FF63B4826B7400
2 changed files with 0 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

41
apps/forgejo/network-policy.yaml
View file

@ -1,18 +1,4 @@
# ---------------------------------------------------- # ----------------------------------------------------
# Default deny (namespace baseline)
# ----------------------------------------------------
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: default-deny
namespace: forgejo
spec:
endpointSelector: {}
ingress: []
egress: []
---
# ----------------------------------------------------
# Ingress only from Gateway API # Ingress only from Gateway API
# ---------------------------------------------------- # ----------------------------------------------------
apiVersion: cilium.io/v2 apiVersion: cilium.io/v2
@ -32,33 +18,6 @@ spec:
- ports: - ports:
- port: "3000" - port: "3000"
protocol: TCP protocol: TCP
---
# ----------------------------------------------------
# DNS (cluster DNS only)
# ----------------------------------------------------
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-dns
namespace: forgejo
spec:
endpointSelector:
matchLabels:
app: forgejo
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: ANY
rules:
dns:
- matchPattern: "*"
# --- # ---
# # ---------------------------------------------------- # # ----------------------------------------------------
# # CI runner access (in-cluster service) # # CI runner access (in-cluster service)

40
apps/navidrome/network-policy.yaml
View file

@ -1,18 +1,4 @@
# ---------------------------------------------------- # ----------------------------------------------------
# Default deny (namespace baseline)
# ----------------------------------------------------
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: default-deny
namespace: navidrome
spec:
endpointSelector: {}
ingress: []
egress: []
---
# ----------------------------------------------------
# Ingress only from Gateway API # Ingress only from Gateway API
# ---------------------------------------------------- # ----------------------------------------------------
apiVersion: cilium.io/v2 apiVersion: cilium.io/v2
@ -33,32 +19,6 @@ spec:
- port: "4533" - port: "4533"
protocol: TCP protocol: TCP
---
# ----------------------------------------------------
# DNS (required)
# ----------------------------------------------------
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: allow-dns
namespace: navidrome
spec:
endpointSelector:
matchLabels:
app: navidrome
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: ANY
rules:
dns:
- matchPattern: "*"
--- ---
# ---------------------------------------------------- # ----------------------------------------------------
# Spotify API access (album art, metadata) # Spotify API access (album art, metadata)