Initial commit

infrastructure/istio/cni-values.yaml

@@ -0,0 +1,6 @@
+profile: ambient
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 100Mi

infrastructure/istio/ingressgateway-values.yaml

@@ -0,0 +1,19 @@
+autoscaling:
+  enabled: true
+  minReplicas: 1
+  maxReplicas: 5
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 64Mi
+  limits:
+    memory: 1024Mi
+
+service:
+  externalTrafficPolicy: Cluster
+  type: LoadBalancer
+  annotations:
+    # External-DNS (UniFi webhook) will create/update these A records.
+    external-dns.alpha.kubernetes.io/hostname: "auth.kube.huskypup.net,grafana.kube.huskypup.net,prometheus.kube.huskypup.net,vault.kube.huskypup.net,mqtt.kube.huskypup.net,ceph.kube.huskypup.net,kiali.kube.huskypup.net,argocd.kube.huskypup.net,n8n.kube.huskypup.net,nextcloud.kube.huskypup.net,teslamate.kube.huskypup.net,homeassistant.kube.huskypup.net,esphome.kube.huskypup.net,frigate.kube.huskypup.net,guacamole.kube.huskypup.net,gitlab.kube.huskypup.net,registry.gitlab.kube.huskypup.net,minio.gitlab.kube.huskypup.net,kas.kube.huskypup.net,everest.kube.huskypup.net,rancher.kube.huskypup.net"
+    external-dns.alpha.kubernetes.io/ttl: "60"

infrastructure/istio/istiod-values.yaml

@@ -0,0 +1,54 @@
+# Istio Ambient Mode - ztunnel handles L4 mTLS, waypoints handle L7
+profile: ambient
+
+pilot:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 3
+  resources:
+    requests:
+      cpu: 10m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+
+# Use Istio CNI for ambient mesh networking (ztunnel traffic redirection)
+cni:
+  enabled: true
+
+meshConfig:
+  # ext_authz provider for Authentik forward-auth (via waypoint proxies)
+  # In ambient mode, ext_authz is enforced by waypoint proxies, not sidecars.
+  # Authentik's forward-auth endpoint is exposed under /outpost.goauthentik.io.
+  extensionProviders:
+    - name: authentik-ext-authz
+      envoyExtAuthzHttp:
+        # Route through Host-rewriting proxy (see authentik/ext-authz-proxy.yaml)
+        # Authentik's embedded outpost only serves forward-auth on Host: auth.kube.huskypup.net
+        service: ext-authz-proxy.authentik.svc.cluster.local
+        port: 4180
+        pathPrefix: /outpost.goauthentik.io/auth/traefik
+        headersToDownstreamOnAllow:
+          - set-cookie
+        headersToUpstreamOnAllow:
+          - cookie
+          - set-cookie
+          - authorization
+          - x-authentik-username
+          - x-authentik-groups
+          - x-authentik-email
+          - x-authentik-name
+          - x-authentik-uid
+        headersToDownstreamOnDeny:
+          - set-cookie
+          - content-type
+          - location
+        includeRequestHeadersInCheck:
+          - cookie
+          - authorization
+        includeAdditionalHeadersInCheck:
+          X-Forwarded-Proto: "%REQ(:SCHEME)%"
+          X-Forwarded-Host: "%REQ(:AUTHORITY)%"
+          X-Forwarded-Uri: "%REQ(:PATH)%"

infrastructure/istio/manifests/apps/authorization-policies-apps.yaml

@@ -0,0 +1,322 @@
+# ==========================================================================
+# Application Namespace Authorization Policies
+# ==========================================================================
+#
+# These ALLOW policies permit the Istio ingress gateway (istio-system),
+# Prometheus, and intra-namespace traffic to reach application workloads.
+#
+# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
+# intra-namespace. Each policy must explicitly allow same-namespace
+# communication for pods to reach their own databases, caches, etc.
+#
+# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
+# ==========================================================================
+
+# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-argocd-access
+  namespace: argocd
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
+    - from:
+        - source:
+            namespaces:
+              - argocd
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-gitlab-access
+  namespace: gitlab
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
+    - from:
+        - source:
+            namespaces:
+              - gitlab
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # ArgoCD pulls from GitLab repos
+    - from:
+        - source:
+            namespaces:
+              - argocd
+    # Redis operator managing Redis instances
+    - from:
+        - source:
+            namespaces:
+              - redis-operator
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- n8n: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-n8n-access
+  namespace: n8n
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (n8n ↔ postgres)
+    - from:
+        - source:
+            namespaces:
+              - n8n
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-nextcloud-access
+  namespace: nextcloud
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (nextcloud ↔ mariadb ↔ redis)
+    - from:
+        - source:
+            namespaces:
+              - nextcloud
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-teslamate-access
+  namespace: teslamate
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (teslamate ↔ postgres)
+    - from:
+        - source:
+            namespaces:
+              - teslamate
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # Grafana reads TeslaMate postgres directly for dashboards
+    - from:
+        - source:
+            namespaces:
+              - grafana
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-home-assistant-access
+  namespace: home-assistant
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (HA ↔ ESPHome)
+    - from:
+        - source:
+            namespaces:
+              - home-assistant
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-frigate-access
+  namespace: frigate
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - frigate
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # Home Assistant accesses Frigate API
+    - from:
+        - source:
+            namespaces:
+              - home-assistant
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-guacamole-access
+  namespace: guacamole
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (guacamole ↔ guacd ↔ postgres)
+    - from:
+        - source:
+            namespaces:
+              - guacamole
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- Nessus: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-nessus-access
+  namespace: nessus
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - nessus
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-rancher-access
+  namespace: cattle-system
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (rancher + fleet + webhook)
+    - from:
+        - source:
+            namespaces:
+              - cattle-system
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus

infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml

@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: istio-mesh-app-enrollment
+  namespace: istio-system
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      restartPolicy: Never
+      containers:
+        - name: enroll
+          image: bitnami/kubectl:1.29
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Enrolling app namespaces in Istio ambient mesh ==="
+
+              # Enroll app namespaces in ambient mesh
+              APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus cattle-system)
+              for ns in "${APP_NAMESPACES[@]}"; do
+                echo "Enrolling $ns in ambient mesh..."
+                kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
+                kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
+              done
+
+              # Attach waypoint proxies for L7 policy enforcement
+              echo "Attaching waypoint proxies to app namespaces..."
+              WAYPOINT_APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus)
+              for ns in "${WAYPOINT_APP_NAMESPACES[@]}"; do
+                kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
+              done
+
+              # Annotate services for NetBird VPN resource auto-discovery
+              echo "Annotating services for NetBird VPN resource discovery..."
+              kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n grafana grafana netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant home-assistant netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n guacamole guacamole netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n nextcloud nextcloud netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n argocd argocd-server netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n frigate frigate netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n teslamate teslamate netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n home-assistant esphome netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/resource="true" --overwrite 2>/dev/null || true
+              kubectl annotate svc -n vault vault netbird.io/resource="true" --overwrite 2>/dev/null || true
+              echo "App namespace enrollment and NetBird annotations complete"

infrastructure/istio/manifests/edge/edge.yaml

@@ -0,0 +1,78 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: istio-kube-huskypup-net
+  namespace: istio-system
+spec:
+  secretName: istio-kube-huskypup-net
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-production
+  dnsNames:
+    - auth.kube.huskypup.net
+    - grafana.kube.huskypup.net
+    - prometheus.kube.huskypup.net
+    - vault.kube.huskypup.net
+    - mqtt.kube.huskypup.net
+    - ceph.kube.huskypup.net
+    - kiali.kube.huskypup.net
+    - argocd.kube.huskypup.net
+    - n8n.kube.huskypup.net
+    - nextcloud.kube.huskypup.net
+    - teslamate.kube.huskypup.net
+    - homeassistant.kube.huskypup.net
+    - esphome.kube.huskypup.net
+    - frigate.kube.huskypup.net
+    - guacamole.kube.huskypup.net
+    - gitlab.kube.huskypup.net
+    - registry.gitlab.kube.huskypup.net
+    - minio.gitlab.kube.huskypup.net
+    - kas.kube.huskypup.net
+    - everest.kube.huskypup.net
+    - rancher.kube.huskypup.net
+    - netbird.kube.huskypup.net
+    - nessus.kube.huskypup.net
+    - scylla-manager.kube.huskypup.net
+
+---
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: edge
+  namespace: istio-system
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+    - port:
+        number: 443
+        name: https
+        protocol: HTTPS
+      hosts:
+        - auth.kube.huskypup.net
+        - grafana.kube.huskypup.net
+        - prometheus.kube.huskypup.net
+        - vault.kube.huskypup.net
+        - mqtt.kube.huskypup.net
+        - ceph.kube.huskypup.net
+        - kiali.kube.huskypup.net
+        - argocd.kube.huskypup.net
+        - n8n.kube.huskypup.net
+        - nextcloud.kube.huskypup.net
+        - teslamate.kube.huskypup.net
+        - homeassistant.kube.huskypup.net
+        - esphome.kube.huskypup.net
+        - frigate.kube.huskypup.net
+        - guacamole.kube.huskypup.net
+        - gitlab.kube.huskypup.net
+        - registry.gitlab.kube.huskypup.net
+        - minio.gitlab.kube.huskypup.net
+        - kas.kube.huskypup.net
+        - everest.kube.huskypup.net
+        - rancher.kube.huskypup.net
+        - netbird.kube.huskypup.net
+        - nessus.kube.huskypup.net
+        - scylla-manager.kube.huskypup.net
+      tls:
+        mode: SIMPLE
+        credentialName: istio-kube-huskypup-net

infrastructure/istio/manifests/mesh/authentik-allow.yaml

@@ -0,0 +1,67 @@
+# ==========================================================================
+# Global Authentik ext_authz Policy - Ingress Gateway
+# ==========================================================================
+#
+# This CUSTOM AuthorizationPolicy runs on the Istio ingress gateway and
+# requires Authentik forward-auth for ALL external traffic, EXCEPT:
+#
+#   1. auth.kube.huskypup.net         - Authentik itself (must be reachable)
+#   2. Services with native OIDC      - They redirect to Authentik themselves
+#   3. Machine-access services        - Docker registry, git agent, MQTT, etc.
+#   4. Vault                          - Has its own auth system
+#
+# How it works:
+#   - The ingress gateway is a regular Envoy proxy (not ztunnel), so CUSTOM
+#     action works directly without waypoint proxies.
+#   - Unauthenticated users get HTTP 302 redirect to Authentik login.
+#   - After login, Authentik sets a session cookie and redirects back.
+#   - Subsequent requests pass ext_authz automatically via cookie.
+#
+# Zero-trust: Any new *.kube.huskypup.net service is AUTOMATICALLY protected.
+# To exclude a new native-OIDC service, add its hostname to notValues below.
+#
+# Per-namespace ext_authz policies in ext-authz-policies.yaml provide
+# defense-in-depth at the waypoint proxy layer.
+# ==========================================================================
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: global-authentik-authz
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  action: CUSTOM
+  provider:
+    name: "authentik-ext-authz"  # Must match meshConfig extensionProviders[].name
+  rules:
+    - to:
+        - operation:
+            hosts: ["*.kube.huskypup.net"]
+      when:
+        - key: request.headers[host]
+          notValues:
+            # --- Authentik itself (must be reachable to log in) ---
+            - "auth.kube.huskypup.net"
+
+            # --- Services with native Authentik OIDC (handle auth themselves) ---
+            - "grafana.kube.huskypup.net"
+            - "argocd.kube.huskypup.net"
+            - "gitlab.kube.huskypup.net"
+            - "n8n.kube.huskypup.net"
+            - "nextcloud.kube.huskypup.net"
+            - "homeassistant.kube.huskypup.net"
+            - "guacamole.kube.huskypup.net"
+            - "rancher.kube.huskypup.net"
+            - "netbird.kube.huskypup.net"
+            - "everest.kube.huskypup.net"
+
+            # --- Machine-access services (ext_authz would break automation) ---
+            - "registry.gitlab.kube.huskypup.net"   # Docker registry (docker push/pull)
+            - "minio.gitlab.kube.huskypup.net"       # Object storage (CI artifacts)
+            - "kas.kube.huskypup.net"                 # GitLab Agent Server (cluster agent)
+            - "mqtt.kube.huskypup.net"                # MQTT protocol (IoT devices)
+
+            # --- Vault (has its own auth system + API access by ESO/apps) ---
+            - "vault.kube.huskypup.net"

infrastructure/istio/manifests/mesh/authorization-policies.yaml

@@ -0,0 +1,363 @@
+# ==========================================================================
+# Zero Trust Authorization Policies - Deny by Default, Allow Explicitly
+# ==========================================================================
+#
+# Policy hierarchy:
+#   1. Mesh-wide DENY (default - everything blocked)
+#   2. Ingress Gateway ALLOW (external traffic entry point)
+#   3. Service-to-service ALLOW (explicit inter-service communication)
+#   4. Monitoring ALLOW (Prometheus scraping, Kiali queries)
+#
+# In ambient mode, L7 policies are enforced by waypoint proxies in each
+# namespace. L4 policies (source namespace/principal) are enforced by ztunnel.
+# Each namespace with ALLOW/CUSTOM policies must have a waypoint Gateway.
+# ==========================================================================
+
+# --- Ingress Gateway: Allow all external traffic through the edge gateway ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-ingress-gateway
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  action: ALLOW
+  rules:
+    - {}
+
+---
+# --- Allow Prometheus to scrape Istio control plane + gateway metrics ---
+# Selector scopes this to istio-system workloads only.
+# Without a selector, policies in the root namespace (istio-system) apply
+# mesh-wide in ambient mode, creating implicit deny for all ambient workloads.
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-prometheus-scraping
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/part-of: istio
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+      to:
+        - operation:
+            ports:
+              - "15014"  # istiod control plane metrics
+              - "15020"  # sidecar/gateway merged metrics
+              - "15090"  # Envoy admin metrics
+
+---
+# --- Allow Kiali to query istiod ---
+# Selector scopes this to istiod only (ambient root namespace caveat above).
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-kiali
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      app: istiod
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/kiali-service-account
+
+---
+# --- Authentik: Allow traffic from ingress + apps doing OIDC ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-authentik-access
+  namespace: authentik
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (server ↔ worker ↔ postgres)
+    - from:
+        - source:
+            namespaces:
+              - authentik
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    # Ingress gateway for browser flows
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    # Apps doing OIDC token exchange
+    - from:
+        - source:
+            namespaces:
+              - argocd
+              - gitlab
+              - grafana
+              - nextcloud
+              - home-assistant
+              - guacamole
+              - netbird
+              - cattle-system
+              - frigate
+              - teslamate
+    # Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Grafana: Allow ingress + Prometheus datasource queries + scraping ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-grafana-access
+  namespace: grafana
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - grafana
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- Prometheus: Allow ingress + self-scraping + Grafana ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-prometheus-access
+  namespace: prometheus
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (Prometheus ↔ alertmanager ↔ node-exporter)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+              - grafana
+    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
+    - from:
+        - source:
+            ipBlocks:
+              - "10.244.0.0/16"
+
+---
+# --- MQTT: Allow Home Assistant + Frigate + ESPHome + Prometheus ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-mqtt-access
+  namespace: mqtt
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - mqtt
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+              - home-assistant
+              - frigate
+              - teslamate
+    # Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- External DNS: Allow internal access + Prometheus ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-external-dns
+  namespace: external-dns
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - external-dns
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    # Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Unpoller: Allow Prometheus scraping ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-unpoller-access
+  namespace: unpoller
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - unpoller
+    # Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Netbird: Allow ingress + Prometheus ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-netbird-access
+  namespace: netbird
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - netbird
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    # Netbird operator querying management API
+    - from:
+        - source:
+            namespaces:
+              - netbird-operator
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- Netbird Operator: Allow intra-namespace + Prometheus ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-netbird-operator-access
+  namespace: netbird-operator
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - netbird-operator
+    # Prometheus scraping (L4-only)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+
+---
+# --- CrowdSec: Allow intra-namespace + CNPG + Prometheus ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-crowdsec-access
+  namespace: crowdsec
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace (LAPI <-> agent)
+    - from:
+        - source:
+            namespaces:
+              - crowdsec
+    # CNPG operator managing database instances
+    - from:
+        - source:
+            namespaces:
+              - cnpg-system
+    # Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # Firewall bouncer (hostNetwork DaemonSet) connects from node IPs
+    - from:
+        - source:
+            ipBlocks:
+              - "172.28.101.0/24"
+
+---
+# --- Scylla Manager: Allow ingress + Prometheus + intra-namespace ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: allow-scylla-manager-access
+  namespace: scylla-manager
+spec:
+  action: ALLOW
+  rules:
+    # Intra-namespace
+    - from:
+        - source:
+            namespaces:
+              - scylla-manager
+    - from:
+        - source:
+            namespaces:
+              - istio-system
+    - from:
+        - source:
+            namespaces:
+              - prometheus
+    # Scylla operator managing clusters
+    - from:
+        - source:
+            namespaces:
+              - scylla-operator

infrastructure/istio/manifests/mesh/ext-authz-policies.yaml

@@ -0,0 +1,139 @@
+# ==========================================================================
+# Istio ext_authz Policies - Forward Auth via Authentik
+# ==========================================================================
+#
+# These policies protect services that don't have native OIDC integration.
+# Istio's ext_authz filter calls Authentik's forward-auth endpoint before
+# allowing traffic through.
+#
+# Services with native OIDC (GitLab, ArgoCD, Grafana, n8n, Home Assistant,
+# Rancher, Nextcloud) do NOT need ext_authz - they handle auth themselves.
+#
+# IMPORTANT: CUSTOM action does NOT support 'from' or source-based matching.
+# We use 'to.operation.hosts' to restrict to external hostnames only.
+# Internal service-to-service traffic uses k8s DNS names (*.svc.cluster.local)
+# which won't match, so it bypasses ext_authz and hits ALLOW policies instead.
+# ==========================================================================
+
+# --- Prometheus: Require Authentik auth for browser access ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-prometheus
+  namespace: prometheus
+spec:
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - prometheus.kube.huskypup.net
+            paths:
+              - /*
+---
+# --- TeslaMate: Require Authentik auth ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-teslamate
+  namespace: teslamate
+spec:
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - teslamate.kube.huskypup.net
+---
+# --- ESPHome: Require Authentik auth ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-esphome
+  namespace: home-assistant
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: esphome
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - esphome.kube.huskypup.net
+---
+# --- Kiali: Require Authentik auth ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-kiali
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kiali
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - kiali.kube.huskypup.net
+---
+# --- Frigate: Require Authentik auth ---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-frigate
+  namespace: frigate
+spec:
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - frigate.kube.huskypup.net
+---
+# --- Scylla Manager: Require Authentik auth ---
+# NOTE: Namespace 'scylla-manager' must exist before applying this policy.
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-scylla-manager
+  namespace: scylla-manager
+spec:
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - scylla-manager.kube.huskypup.net
+---
+# --- Nessus: Require Authentik auth ---
+# NOTE: Namespace 'nessus' must exist before applying this policy.
+# This policy will be skipped if the namespace doesn't exist yet.
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ext-authz-nessus
+  namespace: nessus
+spec:
+  action: CUSTOM
+  provider:
+    name: authentik-ext-authz
+  rules:
+    - to:
+        - operation:
+            hosts:
+              - nessus.kube.huskypup.net

infrastructure/istio/manifests/mesh/monitoring.yaml

@@ -0,0 +1,68 @@
+# Istio Ambient Prometheus Monitors
+# Required for Kiali to display traffic graphs
+#
+# PodMonitor (ztunnel): Scrapes ztunnel L4 metrics from all nodes
+# PodMonitor (waypoint): Scrapes waypoint proxy L7 metrics
+# ServiceMonitor (istiod): Scrapes istiod control plane metrics
+#
+# All require label 'release: kube-prometheus-stack' to be picked up
+# by the Prometheus Operator's selector.
+---
+# ztunnel metrics - L4 mTLS traffic metrics from ambient mesh
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: ztunnel
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: ztunnel
+  namespaceSelector:
+    matchNames:
+      - istio-system
+  podMetricsEndpoints:
+    - path: /stats/prometheus
+      port: http-monitoring
+      interval: 30s
+---
+# Waypoint proxy metrics - L7 AuthorizationPolicy + ext_authz metrics
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: istio-waypoint
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchExpressions:
+      - key: gateway.networking.k8s.io/gateway-name
+        operator: Exists
+  namespaceSelector:
+    any: true
+  podMetricsEndpoints:
+    - path: /stats/prometheus
+      port: http-envoy-prom
+      interval: 30s
+---
+# istiod control plane metrics (unchanged from sidecar mode)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: istiod
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      istio: pilot
+  namespaceSelector:
+    matchNames:
+    - istio-system
+  endpoints:
+  - port: http-monitoring
+    interval: 30s

infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml

@@ -0,0 +1,49 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: istio-mesh-infra-enrollment
+  namespace: istio-system
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      restartPolicy: Never
+      containers:
+        - name: enroll
+          image: bitnami/kubectl:1.29
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Enrolling infrastructure namespaces in Istio ambient mesh ==="
+
+              # Enroll infrastructure namespaces
+              # Excluded: vault (Shamir seal requires manual unseal after restart)
+              # Excluded: kube-system, istio-system, cert-manager, kyverno (system namespaces)
+              INFRA_NAMESPACES=(authentik cnpg-system redis-operator mariadb-system prometheus external-dns grafana mqtt unpoller netbird default gateway scylla-manager crowdsec)
+              for ns in "${INFRA_NAMESPACES[@]}"; do
+                echo "Enrolling $ns in ambient mesh..."
+                kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
+                kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
+              done
+
+              # Attach waypoint proxies for L7 policy enforcement
+              echo "Attaching waypoint proxies to infrastructure namespaces..."
+              WAYPOINT_NAMESPACES=(authentik external-dns grafana mqtt unpoller netbird prometheus scylla-manager crowdsec)
+              for ns in "${WAYPOINT_NAMESPACES[@]}"; do
+                kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
+              done
+
+              # Deploy ext_authz Host-rewriting proxy for Authentik
+              if [ -f /tmp/ext-authz-proxy.yaml ]; then
+                kubectl apply -f /tmp/ext-authz-proxy.yaml
+              fi
+
+              echo "Infrastructure namespace enrollment complete"

infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml

@@ -0,0 +1,44 @@
+# PeerAuthentication PERMISSIVE for namespaces that receive non-mesh traffic
+# The API server calls webhooks from outside the mesh (no SPIFFE identity).
+# The CrowdSec firewall bouncer runs on hostNetwork (no mesh identity)
+# and must connect to LAPI over plaintext.
+# PERMISSIVE allows both mTLS and plaintext inbound.
+---
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: allow-apiserver-webhooks
+  namespace: cnpg-system
+spec:
+  mtls:
+    mode: PERMISSIVE
+---
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: allow-apiserver-webhooks
+  namespace: mariadb-system
+spec:
+  mtls:
+    mode: PERMISSIVE
+---
+# Netbird operator webhook receives calls from the API server
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: allow-apiserver-webhooks
+  namespace: netbird-operator
+spec:
+  mtls:
+    mode: PERMISSIVE
+---
+# CrowdSec firewall bouncer (hostNetwork DaemonSet) connects to LAPI
+# from the host network namespace without a mesh identity
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: allow-hostnetwork-bouncer
+  namespace: crowdsec
+spec:
+  mtls:
+    mode: PERMISSIVE

infrastructure/istio/manifests/mesh/peer-authentication.yaml

@@ -0,0 +1,12 @@
+# Mesh-wide STRICT mTLS - Zero Trust
+# All service-to-service communication must present valid SPIFFE SVID
+# In ambient mode, ztunnel enforces mTLS for all enrolled namespaces
+# Services outside the ambient mesh will be rejected
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  mtls:
+    mode: STRICT

infrastructure/istio/manifests/mesh/waypoint-gateways.yaml

@@ -0,0 +1,279 @@
+# Istio Ambient Waypoint Proxies
+# In ambient mode, L7 AuthorizationPolicies (ALLOW/CUSTOM/ext_authz) are enforced
+# by waypoint proxies, not sidecars. Each namespace with L7 policies needs a waypoint.
+#
+# Waypoints are deployed as Kubernetes Gateway resources using the istio-waypoint
+# gateway class. They handle:
+#   - L7 AuthorizationPolicy evaluation
+#   - ext_authz calls to Authentik for forward-auth
+#   - HTTP header-based routing decisions
+
+# --- Infrastructure namespaces ---
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: istio-system
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: authentik
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: grafana
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: prometheus
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: mqtt
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: external-dns
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: unpoller
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: netbird
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+
+# --- Application namespaces ---
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: argocd
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: gitlab
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: n8n
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: nextcloud
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: teslamate
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: home-assistant
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: frigate
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: guacamole
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: nessus
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: crowdsec
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: scylla-manager
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+    - name: mesh
+      port: 15008
+      protocol: HBONE