54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
{{- if .Values.grafana.istio.enabled }}
|
|
{{- if .Values.grafana.istio.ipBlocks }}
|
|
apiVersion: security.istio.io/v1beta1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: grafana-deny-not-in-ipblocks
|
|
namespace: istio-system
|
|
labels:
|
|
{{ include "kubezero-lib.labels" . | indent 4 }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: istio-ingressgateway
|
|
action: DENY
|
|
rules:
|
|
- from:
|
|
- source:
|
|
notIpBlocks:
|
|
{{- with .Values.grafana.istio.ipBlocks }}
|
|
{{- . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
to:
|
|
- operation:
|
|
hosts: ["{{ .Values.grafana.istio.url }}"]
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.prometheus.istio.enabled }}
|
|
{{- if .Values.prometheus.istio.ipBlocks }}
|
|
---
|
|
apiVersion: security.istio.io/v1beta1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: prometheus-deny-not-in-ipblocks
|
|
namespace: istio-system
|
|
labels:
|
|
{{ include "kubezero-lib.labels" . | indent 4 }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: istio-ingressgateway
|
|
action: DENY
|
|
rules:
|
|
- from:
|
|
- source:
|
|
notIpBlocks:
|
|
{{- with .Values.prometheus.istio.ipBlocks }}
|
|
{{- . | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
to:
|
|
- operation:
|
|
hosts: ["{{ .Values.prometheus.istio.url }}"]
|
|
{{- end }}
|
|
{{- end }}
|