jakman85andClaude Opus 5
4cf9572c58
The hand-authored UniFi VM manifests used column-aligned inline flow mappings
(`{ name: inform, port: 8080, protocol: TCP }`), which yamllint's `commas`
rule rejects as "too many spaces after comma". That made `make -C ci lint` FAIL,
so the merge gate has been BLOCKED on `main` since the UniFi commits landed —
every other static stage was green.
Collapse each run of spaces after a comma to one, and re-align the trailing
comments so the port tables stay readable. Whitespace only:
`kubectl kustomize apps/vms` renders byte-for-byte identically before and after.
The lint config is left untouched — relaxing the rule to make failing files pass
is moving the goalposts, not fixing the code.
Also refresh these files' stale `STAGING / DRAFT` headers: the tree is live,
reconciled by the non-gating `apps-vms` Flux Kustomization.
Gate after this change: spec-immutability / lint / l0 / l1 all green,
MERGE GATE: PASS.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
94 lines
3.5 KiB
YAML
94 lines
3.5 KiB
YAML
---
|
|
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
|
|
#
|
|
# Additive ALLOWs on top of the 10-default-deny baseline. Cilium enforces the UNION of the k8s
|
|
# NetworkPolicy (default-deny) and these CiliumNetworkPolicies (same pattern as pihole). The VM's
|
|
# datapath is the virt-launcher pod, so endpointSelector kubevirt.io/vm=unifi targets the VM.
|
|
#
|
|
# NOTE on selector pinning: fromEntities/toEntities (world/cluster/host) are entity-based and need
|
|
# no namespace pin. The endpointSelector is already namespace-scoped by each CNP's own namespace.
|
|
# (The "must carry io.kubernetes.pod.namespace" caution applies to fromEndpoints/toEndpoints PEER
|
|
# selectors, which we deliberately avoid here.)
|
|
# --------------------------------------------------------------------------------------------
|
|
# 1) INGRESS to the controller: LAN devices + admin browsers reach the L4 ports. LAN hosts are
|
|
# entity `world` to Cilium (off-cluster); `host`/`cluster` cover node-local health probes and
|
|
# any in-cluster caller.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: unifi-allow-l4-ingress
|
|
namespace: unifi
|
|
labels:
|
|
app.kubernetes.io/name: unifi
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
kubevirt.io/vm: unifi
|
|
ingress:
|
|
- fromEntities:
|
|
- world
|
|
- cluster
|
|
- host
|
|
toPorts:
|
|
- ports:
|
|
- { port: "8080", protocol: TCP } # inform / adoption
|
|
- { port: "11443", protocol: TCP } # UOS UI
|
|
- { port: "8443", protocol: TCP } # legacy UI
|
|
- { port: "8880", protocol: TCP } # guest portal http
|
|
- { port: "8843", protocol: TCP } # guest portal https
|
|
- { port: "6789", protocol: TCP } # throughput
|
|
- { port: "3478", protocol: UDP } # STUN
|
|
- { port: "10001", protocol: UDP } # discovery
|
|
---
|
|
# 2) EGRESS from the controller: internet (apt, the UOS installer download, UniFi updates + remote
|
|
# access/STUN to Ubiquiti) + DNS. `world` = default WAN egress (egress-class: internet).
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: unifi-allow-egress
|
|
namespace: unifi
|
|
labels:
|
|
app.kubernetes.io/name: unifi
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
kubevirt.io/vm: unifi
|
|
egress:
|
|
- toEntities:
|
|
- world
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- { port: "53", protocol: UDP }
|
|
- { port: "53", protocol: TCP }
|
|
---
|
|
# 3) EGRESS for the CDI IMPORTER pod (one-shot, during the DataVolume http import). It runs in this
|
|
# default-deny namespace, so without this it cannot reach cloud-images.ubuntu.com and the import
|
|
# hangs. Selects the importer by its CDI label; allows DNS + world. (This is the app-namespace
|
|
# analogue of the CDI-import allow the vm-data-survival runbook notes.)
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: unifi-allow-cdi-import-egress
|
|
namespace: unifi
|
|
labels:
|
|
app.kubernetes.io/name: unifi
|
|
spec:
|
|
endpointSelector:
|
|
matchExpressions:
|
|
- { key: cdi.kubevirt.io, operator: Exists }
|
|
egress:
|
|
- toEntities:
|
|
- world
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- { port: "53", protocol: UDP }
|
|
- { port: "53", protocol: TCP }
|