more network-policies

Author: angelnu

apps/default/forecastle/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - networkpolicy.yaml
   - nfs.yaml
   - secret.yaml
   - release-db.yaml

apps/default/forecastle/release.yaml

@@ -0,0 +1,19 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+  - from:
+    # Allow ssh ingress
+    - ipBlock:
+        cidr: "0.0.0.0/0"
+    ports:
+    - protocol: TCP
+      port: 2222
+      endPort: 2222
+  policyTypes:
+    - Ingress

apps/default/gitea/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - networkpolicy.yaml
   - secret.yaml
   - secret-appdaemon.yaml
   - release-db.yaml

apps/default/gitea/networkpolicy.yaml

@@ -0,0 +1,28 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: home-assistant
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: home-assistant
+  ingress:
+  - from:
+    # Allow homematic ingress from K8S
+    - ipBlock:
+        cidr: "10.0.0.0/8"
+    # Allow homematic ingress from lan
+    - ipBlock:
+        cidr: "192.0.0.0/8"
+    ports:
+    - protocol: TCP
+      port: 2001
+      endPort: 2001
+  egress:
+  - to:
+    # Allow egress to Internet
+    - ipBlock:
+        cidr: "0.0.0.0/0"
+  policyTypes:
+    - Ingress
+    - Egress

apps/default/gonic/kustomization.yaml

@@ -6,9 +6,7 @@ resources:
   - comics
   - deepstack
   - esphome
-  # - forecastle
   - gitea
-  # - gonic
   #- gow
   - hajimari
   - home-assistant

apps/default/gonic/release-fs.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 namespace: kube-system
 resources:
   - kured
-  # - mail
-  # - mailu