From 9ad03f352e5d7565984c848c212be4799cc81838 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Fri, 17 Nov 2023 15:49:06 +0100
Subject: [PATCH] Allow prometheus access to host

---
 .../monitoring-clusterwide-networkpolicy.yaml | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml

diff --git a/helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..6463d81
--- /dev/null
+++ b/helm/cluster_setup/templates/monitoring-clusterwide-networkpolicy.yaml
@@ -0,0 +1,37 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: monitoring
+spec:
+  nodeSelector:
+    # apply to all nodes
+    matchLabels: {}
+  ingress:
+    # prometheus -> monitoring ports
+    - fromEndpoints:
+        - matchLabels:
+            io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+            io.kubernetes.pod.namespace: observability
+      toPorts:
+        - ports:
+            - port: '9100'
+              protocol: TCP
+            - port: '9962'
+              protocol: TCP
+            - port: '9963'
+              protocol: TCP
+            - port: '9965'
+              protocol: TCP
+            - port: '10257'
+              protocol: TCP
+            - port: '10259'
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+            io.kubernetes.pod.namespace: observability
+      toPorts:
+        - ports:
+            - port: '9090'
+              protocol: TCP