Remove all policies that enforce node-level

helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml

@@ -1,12 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: world
-spec:
-  nodeSelector:
-    # apply to all nodes
-    matchLabels: {}
-  egress:
-    # node -> world
-    - toEntities:
-        - world

helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml

@@ -1,23 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: api-server
-spec:
-  nodeSelector:
-    # apply to manager nodes
-    matchLabels:
-      node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
-  ingress:
-    # world -> api server
-    - toPorts:
-        - ports:
-            - port: '16443'
-              protocol: TCP
-  egress:
-    # api server -> kubelet
-    - toEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: '10250'
-              protocol: TCP

helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-health
-specs:
-  - endpointSelector:
-      # apply to health endpoints
-      matchLabels:
-        reserved:health: ''
-    ingress:
-      # cilium agent -> cilium agent
-      - fromEntities:
-          - host
-          - remote-node
-        toPorts:
-          - ports:
-              - port: '4240'
-                protocol: TCP
-  - nodeSelector:
-      # apply to all nodes
-      matchLabels: {}
-    ingress:
-      # cilium agent -> cilium agent
-      - fromEntities:
-          - health
-          - remote-node
-        toPorts:
-          - ports:
-              - port: '4240'
-                protocol: TCP
-    egress:
-      # cilium agent -> cilium agent
-      - toEntities:
-          - health
-          - remote-node
-        toPorts:
-          - ports:
-              - port: '4240'
-                protocol: TCP

helm/cluster_setup/templates/hostaccess-clusterwide-networkpolicy.yaml

@@ -1,31 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: host-access
-spec:
-  nodeSelector:
-    matchLabels: { }
-  ingress:
-    - fromEntities:
-        - world
-      toPorts:
-        - ports:
-            - port: '22'
-              protocol: TCP
-    - fromEntities:
-      - world
-      icmps:
-        - fields:
-            - type: 8
-              family: IPv4
-            - type: 8
-              family: IPv6
-  egress:
-    - toEntities:
-        - world
-      icmps:
-        - fields:
-            - type: 8
-              family: IPv4
-            - type: 8
-              family: IPv6

helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml

@@ -1,30 +1,10 @@
+{{- if .Values.cilium.enabled }}
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: hubble-relay
   namespace: kube-system
 specs:
-  - nodeSelector:
-      # apply to all nodes
-      matchLabels: {}
-    ingress:
-      # hubble relay -> hubble agent
-      - fromEndpoints:
-          - matchLabels:
-              io.cilium.k8s.policy.serviceaccount: hubble-relay
-        toPorts:
-          - ports:
-              - port: '4244'
-                protocol: TCP
-    egress:
-      # kubelet -> hubble relay probes
-      - toEndpoints:
-          - matchLabels:
-              io.cilium.k8s.policy.serviceaccount: hubble-relay
-        toPorts:
-          - ports:
-              - port: '4245'
-                protocol: TCP
   - endpointSelector:
       # apply to hubble relay pods
       matchLabels:
@@ -45,4 +25,5 @@ specs:
         toPorts:
           - ports:
               - port: '4244'
-                protocol: TCP
+                protocol: TCP
+{{- end }}

helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml

@@ -1,35 +1,10 @@
+{{- if .Values.cilium.enabled }}
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: hubble-ui
   namespace: kube-system
 specs:
-  - nodeSelector:
-      # apply to master nodes
-      matchLabels:
-        node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
-    ingress:
-      # hubble ui -> api server
-      - fromEndpoints:
-          - matchLabels:
-              io.cilium.k8s.policy.serviceaccount: hubble-ui
-        toPorts:
-          - ports:
-              - port: '16443'
-                protocol: TCP
-  - endpointSelector:
-      # apply to core dns endpoints
-      matchLabels:
-        io.cilium.k8s.policy.serviceaccount: coredns
-    ingress:
-      # hubble ui -> core dns
-      - fromEndpoints:
-          - matchLabels:
-              io.cilium.k8s.policy.serviceaccount: hubble-ui
-        toPorts:
-          - ports:
-              - port: '53'
-                protocol: UDP
   - endpointSelector:
       # apply to hubble relay endpoints
       matchLabels:
@@ -70,4 +45,5 @@ specs:
         toPorts:
           - ports:
               - port: '53'
-                protocol: UDP
+                protocol: UDP
+{{- end }}

helm/cluster_setup/templates/kubedns-networkpolicy.yaml

@@ -1,40 +1,14 @@
+{{- if .Values.cilium.enabled }}
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
   name: kube-dns
   namespace: kube-system
 specs:
-  - nodeSelector:
-      # apply to master nodes
-      matchLabels:
-        node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
-    ingress:
-      # core dns -> api server
-      - fromEndpoints:
-          - matchLabels:
-              k8s:io.cilium.k8s.policy.serviceaccount: coredns
-        toPorts:
-          - ports:
-              - port: '16443'
-                protocol: TCP
-  - nodeSelector:
-      # apply to all nodes
-      matchLabels: {}
-    egress:
-      # kubelet -> core dns probes
-      - toEndpoints:
-          - matchLabels:
-              k8s:io.cilium.k8s.policy.serviceaccount: coredns
-        toPorts:
-          - ports:
-              - port: '8080'
-                protocol: TCP
-              - port: '8181'
-                protocol: TCP
   - endpointSelector:
       # apply to core dns pods
       matchLabels:
-        k8s:io.cilium.k8s.policy.serviceaccount: coredns
+        io.cilium.k8s.policy.serviceaccount: "coredns"
     ingress:
       # kubelet -> core dns probes
       - fromEntities:
@@ -48,8 +22,8 @@ specs:
       # prometheus -> dns metrics
       - fromEndpoints:
         - matchLabels:
-            k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+            io.cilium.k8s.policy.serviceaccount: "prometheus-kube-prometheus-prometheus"
-            k8s:io.kubernetes.pod.namespace: observability
+            io.kubernetes.pod.namespace: "observability"
         toPorts:
           - ports:
               - port: '9153'
@@ -62,4 +36,5 @@ specs:
               - port: '53'
                 protocol: TCP
               - port: '53'
-                protocol: UDP
+                protocol: UDP
+{{- end }}

helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml

@@ -1,25 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: kubelet
-spec:
-  nodeSelector:
-    # apply to all nodes
-    matchLabels: {}
-  ingress:
-    # prometheus -> kubelet
-    - fromEndpoints:
-        - matchLabels:
-            io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
-            io.kubernetes.pod.namespace: observability
-      toPorts:
-        - ports:
-            - port: '10250'
-              protocol: TCP
-    # api server -> kubelet
-    - fromEntities:
-        - kube-apiserver
-      toPorts:
-        - ports:
-            - port: '10250'
-              protocol: TCP

helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml

@@ -1,37 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: monitoring
-spec:
-  nodeSelector:
-    # apply to all nodes
-    matchLabels: {}
-  ingress:
-    # prometheus -> monitoring ports
-    - fromEndpoints:
-        - matchLabels:
-            io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
-            io.kubernetes.pod.namespace: observability
-      toPorts:
-        - ports:
-            - port: '9100'
-              protocol: TCP
-            - port: '9962'
-              protocol: TCP
-            - port: '9963'
-              protocol: TCP
-            - port: '9965'
-              protocol: TCP
-            - port: '10257'
-              protocol: TCP
-            - port: '10259'
-              protocol: TCP
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
-            io.kubernetes.pod.namespace: observability
-      toPorts:
-        - ports:
-            - port: '9090'
-              protocol: TCP

helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml

@@ -1,24 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: cilium-vxlan
-spec:
-  nodeSelector:
-    # apply to all nodes
-    matchLabels: {}
-  ingress:
-    # node -> vxlan
-    - fromEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: '8472'
-              protocol: UDP
-  egress:
-    # node -> vxlan
-    - toEntities:
-        - remote-node
-      toPorts:
-        - ports:
-            - port: '8472'
-              protocol: UDP