add network-policies

deploy/infra/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
   - cd-serviceaccount.yaml
+  - network-policies.yaml
   - middlewares.yaml
   - ingress-web.yaml
   - ingress-web-public.yaml

deploy/infra/middlewares.yaml

@@ -67,7 +67,7 @@ spec:
 ---
 
 
-piVersion: traefik.io/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: nextcloud-deny-paths

deploy/infra/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cloud-limbosolutions-com
-  labels:
-    name: cloud-limbosolutions-com

deploy/infra/network-policies.yaml

@@ -0,0 +1,44 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-same-namespace-ingress
+spec:
+  endpointSelector: {}   # All pods in this namespace
+  ingress:
+    - fromEndpoints:
+        - matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - cloud-limbosolutions-com
+  
+---
+
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach nextcloud web port
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "80"
+    
+              protocol: TCP
+