Thore Cimbal
b32920c48f
Ingress-only default-deny (egress untouched) plus explicit allows: Traefik (kube-system) + MAS (matrix ns) -> authentik-server on 80/443, and Traefik -> cert-manager's ACME HTTP-01 solver pods on 8089. authentik-postgresql already has its own Bitnami-chart-managed policy, left alone. Part of issue #10.
12 lines
249 B
YAML
Executable File
12 lines
249 B
YAML
Executable File
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- helm-repo.yaml
|
|
- authentik-secret.yaml
|
|
- authentik-blueprints.yaml
|
|
- certificate.yaml
|
|
- authentik.yaml
|
|
- ingress.yaml
|
|
- networkpolicy.yaml
|