Initial commit

infrastructure/cilium/manifests/l2-announcement-policy.yaml

@@ -0,0 +1,23 @@
+# Cilium L2 Announcement Policy - Replaces MetalLB
+# Announces LoadBalancer IPs via ARP on node interfaces
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-policy
+spec:
+  loadBalancerIPs: true
+  externalIPs: true
+  interfaces:
+    - ^eth[0-9]+
+    - ^en[ops][0-9]+
+---
+# IP Pool - Same range as previous MetalLB pool (172.28.101.240-250)
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: default-pool
+spec:
+  blocks:
+    - start: "172.28.101.240"
+      stop: "172.28.101.250"

infrastructure/cilium/manifests/network-policies/baseline.yaml

@@ -0,0 +1,156 @@
+# Baseline CiliumNetworkPolicies for critical infrastructure namespaces
+# Provides L3/L4 ingress segmentation (Istio waypoints handle L7)
+#
+# IMPORTANT: CiliumNetworkPolicy egress rules with empty `{}` only match
+# Cilium-managed endpoints — NOT kube-apiserver, host, remote-node, or world.
+# Omit egress rules entirely to allow all egress (default behavior).
+# Ingress rules must explicitly include fromEntities for host/kube-apiserver
+# traffic (health probes, API server webhooks, kubelet).
+
+# --- Vault: Only accessible from ESO, authentik sync scripts, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vault-ingress
+  namespace: vault
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+            istio: ingressgateway
+    # External Secrets Operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: external-secrets
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # Vault internal (raft replication)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+
+# --- Authentik: Accessible from ingress, apps doing OIDC, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: authentik-ingress
+  namespace: authentik
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal authentik traffic (server <-> worker, pg access)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: authentik
+    # Apps doing OIDC token exchange
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: argocd
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: gitlab
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: n8n
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: nextcloud
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: home-assistant
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: guacamole
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: netbird
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cattle-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- CrowdSec: LAPI + agent + Prometheus + CNPG ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crowdsec-ingress
+  namespace: crowdsec
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Intra-namespace (LAPI <-> agent)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: crowdsec
+    # CNPG operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cnpg-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- Rook-Ceph: Only internal + Prometheus + CSI consumers ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: rook-ceph-ingress
+  namespace: rook-ceph
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks, CSI mounts)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway (Ceph dashboard)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal Ceph traffic
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: rook-ceph
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # CSI consumers (any namespace can mount Ceph volumes via CSI)
+    - fromEndpoints:
+        - {}

infrastructure/cilium/manifests/network-policies/dns.yaml

@@ -0,0 +1,23 @@
+# Allow all pods to reach CoreDNS for name resolution
+# Uses enableDefaultDeny: false to avoid blocking non-DNS egress traffic
+# Istio AuthorizationPolicies handle zero-trust enforcement at L7
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  endpointSelector: {}
+  enableDefaultDeny:
+    egress: false
+    ingress: false
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

infrastructure/cilium/manifests/network-policies/health-probes.yaml

@@ -0,0 +1,17 @@
+# Allow SNAT'd kubelet health probes into ambient mesh pods
+# Istio ambient rewrites kubelet probe source to 169.254.7.127 (link-local)
+# so ztunnel can identify and skip these packets. This policy ensures
+# CiliumNetworkPolicies don't block the rewritten probe traffic.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ambient-hostprobes
+spec:
+  description: "Allows SNAT-ed kubelet health check probes into ambient pods"
+  enableDefaultDeny:
+    egress: false
+    ingress: false
+  endpointSelector: {}
+  ingress:
+    - fromCIDR:
+        - "169.254.7.127/32"