53 lines
1.7 KiB
Django/Jinja
53 lines
1.7 KiB
Django/Jinja
# SPDX-License-Identifier: MIT-0
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: {{ wikideck_name | to_json }}
|
|
namespace: {{ wikideck_namespace | to_json }}
|
|
labels:
|
|
app.kubernetes.io/name: wikideck
|
|
app.kubernetes.io/instance: {{ wikideck_name | to_json }}
|
|
app.kubernetes.io/managed-by: ansible
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: wikideck
|
|
app.kubernetes.io/instance: {{ wikideck_name | to_json }}
|
|
policyTypes: [Ingress, Egress]
|
|
{% if wikideck_network_policy_ingress_from | length > 0 %}
|
|
ingress:
|
|
- from: {{ wikideck_network_policy_ingress_from | to_json }}
|
|
ports:
|
|
- protocol: TCP
|
|
port: 3001
|
|
{% else %}
|
|
ingress: []
|
|
{% endif %}
|
|
{% set public_egress = wikideck_peers | length > 0 and wikideck_network_policy_https_to | length > 0 and wikideck_network_policy_https_ports | length > 0 %}
|
|
{% if wikideck_network_policy_dns_to | length == 0 and not public_egress and (wikideck_peers | length == 0 or wikideck_network_policy_peer_egress | length == 0) %}
|
|
egress: []
|
|
{% else %}
|
|
egress:
|
|
{% if wikideck_network_policy_dns_to | length > 0 %}
|
|
- to: {{ wikideck_network_policy_dns_to | to_json }}
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
{% endif %}
|
|
{% if public_egress %}
|
|
- to: {{ wikideck_network_policy_https_to | to_json }}
|
|
ports:
|
|
{% for port in wikideck_network_policy_https_ports %}
|
|
- protocol: TCP
|
|
port: {{ port | int }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% if wikideck_peers | length > 0 %}
|
|
{% for rule in wikideck_network_policy_peer_egress %}
|
|
- {{ rule | to_json }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endif %}
|