Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
{{- if .Values.networkPolicy.enabled }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: {{ include "aptly.fullname" . }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
{{- include "aptly.selectorLabels" . | nindent 6 }}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
{{- if .Values.networkPolicy.allowedNamespaces }}
|
|
# Restricted to these namespaces (plus this one). NOTE: this applies to
|
|
# the whole nginx:8080 endpoint — read and write share one port, so this
|
|
# cannot itself express "reads are public, writes are cluster-only" any
|
|
# more precisely than security.write.allowCIDRs can (see the warning
|
|
# rendered into nginx.conf for that). Use it to fence the Service off
|
|
# from unrelated namespaces, not as a read/write split.
|
|
- from:
|
|
- podSelector: {}
|
|
{{- range .Values.networkPolicy.allowedNamespaces }}
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: {{ . }}
|
|
{{- end }}
|
|
{{- else }}
|
|
- {}
|
|
{{- end }}
|
|
{{- with .Values.networkPolicy.extraIngress }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
egress:
|
|
{{- if .Values.networkPolicy.egress.allowAll }}
|
|
- {}
|
|
{{- else }}
|
|
- to:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
{{- with .Values.networkPolicy.egress.extra }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|