Added cilium network policy

helm/argocd/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: argocd-configuration
-version: 0.1.6
+version: 0.2.0
 type: application
 description: "ArgoCD configuration which requires Argo CD to be installed separately."
 maintainers:
@@ -8,8 +8,8 @@ maintainers:
     url: https://2martens.de
 annotations:
   artifacthub.io/changes: |
-    - kind: fixed
-      description: Fixed port number
+    - kind: added
+      description: Added cilium network policy
   artifacthub.io/signKey: |
     fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
     url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc

helm/argocd/templates/network-policy.yaml

@@ -0,0 +1,88 @@
+{{- if .Values.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: argocd
+  namespace: {{ .Release.Namespace }}
+specs:
+  - nodeSelector:
+      # apply to all nodes
+      matchLabels: {}
+    egress:
+      # kubelet -> probes
+      - toEndpoints:
+          - matchLabels:
+              k8s:app.kubernetes.io/name: argocd-server
+        toPorts:
+          - ports:
+              - port: '8080'
+                protocol: TCP
+      - toEndpoints:
+          - matchLabels:
+              k8s:app.kubernetes.io/name: argocd-application-controller
+        toPorts:
+          - ports:
+              - port: '8082'
+                protocol: TCP
+      - toEndpoints:
+          - matchLabels:
+              k8s:app.kubernetes.io/name: argocd-repo-server
+        toPorts:
+          - ports:
+              - port: '8084'
+                protocol: TCP
+  - endpointSelector:
+      # apply to core dns pods
+      matchLabels:
+        k8s:app.kubernetes.io/name: argocd-server
+    ingress:
+      # kubelet -> probes
+      - fromEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '8080'
+                protocol: TCP
+      # ingress -> server
+      - fromEndpoints:
+          - matchLabels:
+              k8s:io.cilium.k8s.policy.serviceaccount: nginx-ingress-microk8s-serviceaccount
+              k8s:io.kubernetes.pod.namespace: ingress
+        toPorts:
+          - ports:
+              - port: '8080'
+                protocol: TCP
+      # prometheus -> server metrics
+      - fromEndpoints:
+          - matchLabels:
+              k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+              k8s:io.kubernetes.pod.namespace: observability
+        toPorts:
+          - ports:
+              - port: '8083'
+                protocol: TCP
+  - endpointSelector:
+      # apply to core dns pods
+      matchLabels:
+        k8s:app.kubernetes.io/name: argocd-application-controller
+    ingress:
+      # kubelet -> probes
+      - fromEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '8082'
+                protocol: TCP
+  - endpointSelector:
+      # apply to core dns pods
+      matchLabels:
+        k8s:app.kubernetes.io/name: argocd-repo-server
+    ingress:
+      # kubelet -> probes
+      - fromEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '8084'
+                protocol: TCP
+{{- end }}

helm/argocd/values.yaml

@@ -17,4 +17,7 @@ gateway:
   certIssuer: lets-encrypt
 
 # should be overriden for the specific installation
-environment: ""
+environment: ""
+
+cilium:
+  enabled: false