fluxer/deploy/helm/fluxer/templates/networkpolicy.yaml

{{- include "fluxer.validate" . }}
{{- if .Values.networkPolicy.enabled }}
{{- $v := .Values }}
{{- $release := dict "app.kubernetes.io/instance" .Release.Name }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fluxer
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "fluxer.labels" (dict "root" . "name" "fluxer" "component" "network") | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- toYaml $release | nindent 6 }}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              {{- toYaml $release | nindent 14 }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fluxer-edge
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-edge" "component" "network") | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "fluxer.selectorLabels" (dict "root" . "name" "edge") | nindent 6 }}
  policyTypes:
    - Ingress
  ingress:
    - ports:
        - port: 8080
          protocol: TCP
      {{- with $v.networkPolicy.ingressNamespaceSelector }}
      from:
        - namespaceSelector:
            {{- toYaml . | nindent 12 }}
        {{- if and $v.livekit.enabled (eq $v.livekit.expose "hostNetwork") }}
        {{- range $v.livekit.nodeCIDRs }}
        - ipBlock:
            cidr: {{ . }}
        {{- end }}
        {{- end }}
      {{- end }}
    {{- if eq $v.edge.expose "loadBalancer" }}
    - ports:
        - port: 80
          protocol: TCP
        - port: 443
          protocol: TCP
        - port: 443
          protocol: UDP
    {{- end }}
{{- if and $v.livekit.enabled (ne $v.livekit.expose "hostNetwork") }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fluxer-livekit
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-livekit" "component" "network") | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "fluxer.selectorLabels" (dict "root" . "name" "livekit") | nindent 6 }}
  policyTypes:
    - Ingress
  ingress:
    - ports:
        - port: {{ ternary $v.livekit.nodePorts.tcp $v.livekit.tcpPort (eq $v.livekit.expose "nodePort") }}
          protocol: TCP
        - port: {{ ternary $v.livekit.nodePorts.udp $v.livekit.udpPort (eq $v.livekit.expose "nodePort") }}
          protocol: UDP
{{- end }}
{{- end }}