From 1125e52a8315473407f033e40277088a1df8759f Mon Sep 17 00:00:00 2001 From: ATM Platform Date: Fri, 2 Oct 2026 16:57:08 +0000 Subject: [PATCH] feat(tenants): saida do BFF para o convite publico de outra escola (federacao de competicoes) --- tenants/acme/22-netpol-federacao.yaml | 23 ++++++++++++++++++++++ tenants/escolinha/22-netpol-federacao.yaml | 23 ++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 tenants/acme/22-netpol-federacao.yaml create mode 100644 tenants/escolinha/22-netpol-federacao.yaml diff --git a/tenants/acme/22-netpol-federacao.yaml b/tenants/acme/22-netpol-federacao.yaml new file mode 100644 index 0000000..8ccac36 --- /dev/null +++ b/tenants/acme/22-netpol-federacao.yaml @@ -0,0 +1,23 @@ +# Competicao entre escolas (2026-10-02): o BFF desta escola entrega o elenco ao convite publico de OUTRA escola, +# pela internet (https://.athleticmap.com). Sem isto a deny-cross-tenant barra a saida. +# So os pods com o BFF; so o IP da VPS (entrada 443) e o Traefik que recebe depois do redirecionamento (8443). +# O host de destino ainda e limitado a *.athleticmap.com no codigo (FederacaoBffController). +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-federacao + namespace: acme-prod +spec: + podSelector: + matchLabels: { athleticmap.io/bff-aqui: "true" } + policyTypes: [Egress] + egress: + - to: + - ipBlock: { cidr: 187.77.37.184/32 } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: kube-system } + podSelector: + matchLabels: { app.kubernetes.io/name: traefik } + ports: + - { protocol: TCP, port: 443 } + - { protocol: TCP, port: 8443 } diff --git a/tenants/escolinha/22-netpol-federacao.yaml b/tenants/escolinha/22-netpol-federacao.yaml new file mode 100644 index 0000000..af9a60e --- /dev/null +++ b/tenants/escolinha/22-netpol-federacao.yaml @@ -0,0 +1,23 @@ +# Competicao entre escolas (2026-10-02): o BFF desta escola entrega o elenco ao convite publico de OUTRA escola, +# pela internet (https://.athleticmap.com). Sem isto a deny-cross-tenant barra a saida. +# So os pods com o BFF; so o IP da VPS (entrada 443) e o Traefik que recebe depois do redirecionamento (8443). +# O host de destino ainda e limitado a *.athleticmap.com no codigo (FederacaoBffController). +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: egress-federacao + namespace: escolinha-prod +spec: + podSelector: + matchLabels: { athleticmap.io/bff-aqui: "true" } + policyTypes: [Egress] + egress: + - to: + - ipBlock: { cidr: 187.77.37.184/32 } + - namespaceSelector: + matchLabels: { kubernetes.io/metadata.name: kube-system } + podSelector: + matchLabels: { app.kubernetes.io/name: traefik } + ports: + - { protocol: TCP, port: 443 } + - { protocol: TCP, port: 8443 }