Initial commit

infrastructure/cilium/manifests/network-policies/baseline.yaml

@@ -0,0 +1,156 @@
+# Baseline CiliumNetworkPolicies for critical infrastructure namespaces
+# Provides L3/L4 ingress segmentation (Istio waypoints handle L7)
+#
+# IMPORTANT: CiliumNetworkPolicy egress rules with empty `{}` only match
+# Cilium-managed endpoints — NOT kube-apiserver, host, remote-node, or world.
+# Omit egress rules entirely to allow all egress (default behavior).
+# Ingress rules must explicitly include fromEntities for host/kube-apiserver
+# traffic (health probes, API server webhooks, kubelet).
+
+# --- Vault: Only accessible from ESO, authentik sync scripts, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vault-ingress
+  namespace: vault
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+            istio: ingressgateway
+    # External Secrets Operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: external-secrets
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # Vault internal (raft replication)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vault
+
+# --- Authentik: Accessible from ingress, apps doing OIDC, and Prometheus ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: authentik-ingress
+  namespace: authentik
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal authentik traffic (server <-> worker, pg access)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: authentik
+    # Apps doing OIDC token exchange
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: argocd
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: gitlab
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: n8n
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: nextcloud
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: home-assistant
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: guacamole
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: netbird
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cattle-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- CrowdSec: LAPI + agent + Prometheus + CNPG ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crowdsec-ingress
+  namespace: crowdsec
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Intra-namespace (LAPI <-> agent)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: crowdsec
+    # CNPG operator
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cnpg-system
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+
+# --- Rook-Ceph: Only internal + Prometheus + CSI consumers ---
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: rook-ceph-ingress
+  namespace: rook-ceph
+spec:
+  endpointSelector: {}
+  ingress:
+    # Kubernetes API server and kubelet (health probes, webhooks, CSI mounts)
+    - fromEntities:
+        - host
+        - kube-apiserver
+        - remote-node
+    # Istio ingress gateway (Ceph dashboard)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: istio-system
+    # Internal Ceph traffic
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: rook-ceph
+    # Prometheus scraping
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: prometheus
+    # CSI consumers (any namespace can mount Ceph volumes via CSI)
+    - fromEndpoints:
+        - {}