gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Scooby Husky
2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
+322
View File
@@ -0,0 +1,322 @@
# ==========================================================================
# Application Namespace Authorization Policies
# ==========================================================================
#
# These ALLOW policies permit the Istio ingress gateway (istio-system),
# Prometheus, and intra-namespace traffic to reach application workloads.
#
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
# intra-namespace. Each policy must explicitly allow same-namespace
# communication for pods to reach their own databases, caches, etc.
#
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
# ==========================================================================
# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-argocd-access
namespace: argocd
spec:
action: ALLOW
rules:
# Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
- from:
- source:
namespaces:
- argocd
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-gitlab-access
namespace: gitlab
spec:
action: ALLOW
rules:
# Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
- from:
- source:
namespaces:
- gitlab
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# ArgoCD pulls from GitLab repos
- from:
- source:
namespaces:
- argocd
# Redis operator managing Redis instances
- from:
- source:
namespaces:
- redis-operator
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-n8n-access
namespace: n8n
spec:
action: ALLOW
rules:
# Intra-namespace (n8n ↔ postgres)
- from:
- source:
namespaces:
- n8n
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
---
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-nextcloud-access
namespace: nextcloud
spec:
action: ALLOW
rules:
# Intra-namespace (nextcloud ↔ mariadb ↔ redis)
- from:
- source:
namespaces:
- nextcloud
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-teslamate-access
namespace: teslamate
spec:
action: ALLOW
rules:
# Intra-namespace (teslamate ↔ postgres)
- from:
- source:
namespaces:
- teslamate
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# Grafana reads TeslaMate postgres directly for dashboards
- from:
- source:
namespaces:
- grafana
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-home-assistant-access
namespace: home-assistant
spec:
action: ALLOW
rules:
# Intra-namespace (HA ↔ ESPHome)
- from:
- source:
namespaces:
- home-assistant
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-frigate-access
namespace: frigate
spec:
action: ALLOW
rules:
# Intra-namespace
- from:
- source:
namespaces:
- frigate
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# Home Assistant accesses Frigate API
- from:
- source:
namespaces:
- home-assistant
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-guacamole-access
namespace: guacamole
spec:
action: ALLOW
rules:
# Intra-namespace (guacamole ↔ guacd ↔ postgres)
- from:
- source:
namespaces:
- guacamole
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Nessus: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-nessus-access
namespace: nessus
spec:
action: ALLOW
rules:
# Intra-namespace
- from:
- source:
namespaces:
- nessus
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
---
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-rancher-access
namespace: cattle-system
spec:
action: ALLOW
rules:
# Intra-namespace (rancher + fleet + webhook)
- from:
- source:
namespaces:
- cattle-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
+55
View File
@@ -0,0 +1,55 @@
apiVersion: batch/v1
kind: Job
metadata:
name: istio-mesh-app-enrollment
namespace: istio-system
annotations:
argocd.argoproj.io/hook: PostSync
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
argocd.argoproj.io/sync-wave: "1"
spec:
backoffLimit: 3
ttlSecondsAfterFinished: 300
template:
spec:
serviceAccountName: argocd-hook-sa
restartPolicy: Never
containers:
- name: enroll
image: bitnami/kubectl:1.29
command:
- /bin/bash
- -c
- |
set -euo pipefail
echo "=== Enrolling app namespaces in Istio ambient mesh ==="
# Enroll app namespaces in ambient mesh
APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus cattle-system)
for ns in "${APP_NAMESPACES[@]}"; do
echo "Enrolling $ns in ambient mesh..."
kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
done
# Attach waypoint proxies for L7 policy enforcement
echo "Attaching waypoint proxies to app namespaces..."
WAYPOINT_APP_NAMESPACES=(argocd gitlab n8n nextcloud teslamate home-assistant frigate guacamole nessus)
for ns in "${WAYPOINT_APP_NAMESPACES[@]}"; do
kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
done
# Annotate services for NetBird VPN resource auto-discovery
echo "Annotating services for NetBird VPN resource discovery..."
kubectl annotate svc -n gitlab gitlab-webservice-default netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n grafana grafana netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n home-assistant home-assistant netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n guacamole guacamole netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n nextcloud nextcloud netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n argocd argocd-server netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n frigate frigate netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n teslamate teslamate netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n home-assistant esphome netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n prometheus kube-prometheus-stack-prometheus netbird.io/resource="true" --overwrite 2>/dev/null || true
kubectl annotate svc -n vault vault netbird.io/resource="true" --overwrite 2>/dev/null || true
echo "App namespace enrollment and NetBird annotations complete"