From 517f7070be3eecd7f5c3518103bf71d0c68fec3a Mon Sep 17 00:00:00 2001
From: Denis Patrakeev <denis.patrakeev@avroid.team>
Date: Tue, 25 Feb 2025 13:53:33 +0300
Subject: [PATCH] [DO-1600] fix trivy_operator 4 (!44)

[DO-1600]

Reviewed-on: https://git.avroid.tech/K8s/k8s-configs/pulls/44
---
 ...cd-apps-trivy-operator-network-policy.yaml | 64 +++++++++++++++----
 1 file changed, 50 insertions(+), 14 deletions(-)

diff --git a/clusters/k8s-avroid-office.prod.local/namespaces/avroid-prod/security/trivy-operator/argocd-apps-trivy-operator-network-policy.yaml b/clusters/k8s-avroid-office.prod.local/namespaces/avroid-prod/security/trivy-operator/argocd-apps-trivy-operator-network-policy.yaml
index 1a05aff..7fac3ae 100644
--- a/clusters/k8s-avroid-office.prod.local/namespaces/avroid-prod/security/trivy-operator/argocd-apps-trivy-operator-network-policy.yaml
+++ b/clusters/k8s-avroid-office.prod.local/namespaces/avroid-prod/security/trivy-operator/argocd-apps-trivy-operator-network-policy.yaml
@@ -17,38 +17,74 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: ingress-nginx
-    # https://aquasecurity.github.io/trivy-operator/v0.23.0/getting-started/installation/troubleshooting/#installing-the-operator-in-a-namespace-with-default-deny-all-egressingress-network-policies
-    
 ---
+# https://aquasecurity.github.io/trivy-operator/v0.23.0/getting-started/installation/troubleshooting/#installing-the-operator-in-a-namespace-with-default-deny-all-egressingress-network-policies
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name:  trivy-operator-out
+  name:  trivy-operator-out-443-4954
   namespace: avroid-prod
   labels:
     app.kubernetes.io/managed-by: argocd
 spec:
-  podSelector: {}
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: trivy-operator
   policyTypes:
     - Egress
   ingress: []
   egress:
-    # https://aquasecurity.github.io/trivy-operator/v0.23.0/getting-started/installation/troubleshooting/#installing-the-operator-in-a-namespace-with-default-deny-all-egressingress-network-policies
     - ports:
-        - port: 53
-          protocol: TCP
-        - port: 53
-          protocol: UDP
         - port: 443
           protocol: TCP
         - port: 4954
           protocol: TCP
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+---
+# https://aquasecurity.github.io/trivy-operator/v0.23.0/getting-started/installation/troubleshooting/#installing-the-operator-in-a-namespace-with-default-deny-all-egressingress-network-policies
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name:  trivy-operator-out-to-kubeapi
+  namespace: avroid-prod
+  labels:
+    app.kubernetes.io/managed-by: argocd
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: trivy-operator
+  policyTypes:
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 172.24.0.1/32
+---
+# https://aquasecurity.github.io/trivy-operator/v0.23.0/getting-started/installation/troubleshooting/#installing-the-operator-in-a-namespace-with-default-deny-all-egressingress-network-policies
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name:  trivy-operator-out-to-kube-system-dns
+  namespace: avroid-prod
+  labels:
+    app.kubernetes.io/managed-by: argocd
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: trivy-operator
+  policyTypes:
+    - Egress
+  ingress: []
+  egress:
+    - ports:
+        - port: 53
+          protocol: TCP
+        - port: 53
+          protocol: UDP
     - to:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: trivy
-        - ipBlock:
-            cidr: 172.24.0.1/32