namespace policies for ingestion

bcgov · Mar 12, 2024 · 0ceabb2 · 0ceabb2
1 parent f673c24
commit 0ceabb2
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 0 deletions.
diff --git a/oc/auto-label-ingestion.yaml b/oc/auto-label-ingestion.yaml
@@ -0,0 +1,23 @@
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: add-ingestion-labels
+spec:
+  background: false
+  failurePolicy: Ignore
+  rules:
+    - match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              selector:
+                matchLabels:
+                  task_id: ingestion_task
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            labels:
+              DataClass: High
+      name: add-data-class-label
+  validationFailureAction: audit
diff --git a/oc/net-pol-ingestion.yaml b/oc/net-pol-ingestion.yaml
@@ -0,0 +1,16 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-openmetadata-ingestion
+spec:
+  podSelector:
+    matchLabels:
+      task_id: ingestion_task
+  ingress:
+    - {}
+  egress:
+    - {}
+  policyTypes:
+    - Ingress
+    - Egress
+status: {}