Cilium-SPIFFE integration tools

deny-all.yaml

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "deny-all-egress"
spec:
  endpointSelector:
    {}
  egress:
  - {}

spiffe-based.yaml

# Allow pods running with the default service account to contact pods
# running with the foo service account.
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "spiffe-based"
spec:
  endpointSelector:
    matchLabels:
      spiffe://example.org/ns/default/sa/default: ""
  egress:
  - toEndpoints:
    - matchLabels:
        spiffe://example.org/ns/default/sa/foo: ""

tls-upgrade.yaml

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "tls-upgrade"
spec:
  endpointSelector:
    matchLabels:
      type: mypod
  egress:
  - toPorts:
    - ports:
      - port: "8443"
        protocol: "TCP"
      originatingTLS:
        spiffe:
          peerIDs:
            - spiffe://example.org/server
      rules:
        http:
        - {}