Initial commit

infrastructure/cilium/manifests/l2-announcement-policy.yaml

@@ -0,0 +1,23 @@
+# Cilium L2 Announcement Policy - Replaces MetalLB
+# Announces LoadBalancer IPs via ARP on node interfaces
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-policy
+spec:
+  loadBalancerIPs: true
+  externalIPs: true
+  interfaces:
+    - ^eth[0-9]+
+    - ^en[ops][0-9]+
+---
+# IP Pool - Same range as previous MetalLB pool (172.28.101.240-250)
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: default-pool
+spec:
+  blocks:
+    - start: "172.28.101.240"
+      stop: "172.28.101.250"

infrastructure/cilium/manifests/network-policies/baseline.yaml

@@ -0,0 +1,156 @@
+# Baseline CiliumNetworkPolicies for critical infrastructure namespaces
+# Provides L3/L4 ingress segmentation (Istio waypoints handle L7)
+#
+# IMPORTANT: CiliumNetworkPolicy egress rules with empty `{}` only match
+# Cilium-managed endpoints — NOT kube-apiserver, host, remote-node, or world.
+# Omit egress rules entirely to allow all egress (default behavior).
+# Ingress rules must explicitly include fromEntities for host/kube-apiserver
+# traffic (health probes, API server webhooks, kubelet).
+
+# --- Vault: Only accessible from ESO, authentik sync scripts, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vault-ingress
+  namespace: vault
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+            istio: ingressgateway
+    # External Secrets Operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: external-secrets
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # Vault internal (raft replication)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+
+# --- Authentik: Accessible from ingress, apps doing OIDC, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: authentik-ingress
+  namespace: authentik
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal authentik traffic (server <-> worker, pg access)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: authentik
+    # Apps doing OIDC token exchange
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: argocd
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: gitlab
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: n8n
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: nextcloud
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: home-assistant
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: guacamole
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: netbird
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cattle-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- CrowdSec: LAPI + agent + Prometheus + CNPG ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crowdsec-ingress
+  namespace: crowdsec
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Intra-namespace (LAPI <-> agent)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: crowdsec
+    # CNPG operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cnpg-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- Rook-Ceph: Only internal + Prometheus + CSI consumers ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: rook-ceph-ingress
+  namespace: rook-ceph
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks, CSI mounts)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway (Ceph dashboard)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal Ceph traffic
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: rook-ceph
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # CSI consumers (any namespace can mount Ceph volumes via CSI)
+    - fromEndpoints:
+        - {}

infrastructure/cilium/manifests/network-policies/dns.yaml

@@ -0,0 +1,23 @@
+# Allow all pods to reach CoreDNS for name resolution
+# Uses enableDefaultDeny: false to avoid blocking non-DNS egress traffic
+# Istio AuthorizationPolicies handle zero-trust enforcement at L7
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  endpointSelector: {}
+  enableDefaultDeny:
+    egress: false
+    ingress: false
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

infrastructure/cilium/manifests/network-policies/health-probes.yaml

@@ -0,0 +1,17 @@
+# Allow SNAT'd kubelet health probes into ambient mesh pods
+# Istio ambient rewrites kubelet probe source to 169.254.7.127 (link-local)
+# so ztunnel can identify and skip these packets. This policy ensures
+# CiliumNetworkPolicies don't block the rewritten probe traffic.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ambient-hostprobes
+spec:
+  description: "Allows SNAT-ed kubelet health check probes into ambient pods"
+  enableDefaultDeny:
+    egress: false
+    ingress: false
+  endpointSelector: {}
+  ingress:
+    - fromCIDR:
+        - "169.254.7.127/32"

infrastructure/cilium/values.yaml

@@ -0,0 +1,120 @@
+# Cilium CNI - eBPF-based networking with kube-proxy replacement
+# Replaces: Calico CNI + kube-proxy + MetalLB
+
+# Full kube-proxy replacement via eBPF
+kubeProxyReplacement: true
+k8sServiceHost: 172.28.101.40
+k8sServicePort: 6443
+
+# IPAM - use existing pod CIDR
+ipam:
+  mode: kubernetes
+  operator:
+    clusterPoolIPv4PodCIDRList:
+      - "10.244.0.0/16"
+
+# Explicitly set devices to avoid using leftover Calico tunl0 interface
+devices: "ens+"
+
+# Native routing (no encapsulation overhead)
+routingMode: native
+autoDirectNodeRoutes: true
+ipv4NativeRoutingCIDR: "10.244.0.0/16"
+
+# eBPF features
+bpf:
+  masquerade: false          # Must be false for Istio ambient (breaks link-local SNAT for health probes)
+  tproxy: true
+  lbExternalClusterIP: true
+  hostLegacyRouting: true    # Use iptables host routing (eBPF host routing drops 169.254.7.127 packets)
+
+# Socket LB - restrict to host namespace for Istio ambient compatibility
+socketLB:
+  hostNamespaceOnly: true
+
+# L2 announcements (replaces MetalLB)
+l2announcements:
+  enabled: true
+
+# Allow istio-cni to coexist
+cni:
+  exclusive: false
+
+# Hubble observability
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
+      limits:
+        memory: 256Mi
+  ui:
+    enabled: true
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
+      limits:
+        memory: 128Mi
+  metrics:
+    enabled:
+      - dns
+      - drop
+      - tcp
+      - flow
+      - port-distribution
+      - icmp
+      - httpV2:exemplars=true;labelsContext=source_ip,source_namespace,source_workload,destination_ip,destination_namespace,destination_workload,traffic_direction
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: kube-prometheus-stack
+
+# Operator settings
+operator:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 10m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+
+# Agent resources
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    memory: 512Mi
+
+# Prometheus metrics
+prometheus:
+  enabled: true
+  serviceMonitor:
+    enabled: true
+    labels:
+      release: kube-prometheus-stack
+
+# Security
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE