gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Scooby Husky
2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
+322
View File
@@ -0,0 +1,322 @@
# ==========================================================================
# Application Namespace Authorization Policies
# ==========================================================================
#
# These ALLOW policies permit the Istio ingress gateway (istio-system),
# Prometheus, and intra-namespace traffic to reach application workloads.
#
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
# intra-namespace. Each policy must explicitly allow same-namespace
# communication for pods to reach their own databases, caches, etc.
#
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
# ==========================================================================
# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-argocd-access
namespace: argocd
spec:
action: ALLOW
rules:
# Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
- from:
- source:
namespaces:
- argocd
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-gitlab-access
namespace: gitlab
spec:
action: ALLOW
rules:
# Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
- from:
- source:
namespaces:
- gitlab
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# ArgoCD pulls from GitLab repos
- from:
- source:
namespaces:
- argocd
# Redis operator managing Redis instances
- from:
- source:
namespaces:
- redis-operator
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-n8n-access
namespace: n8n
spec:
action: ALLOW
rules:
# Intra-namespace (n8n ↔ postgres)
- from:
- source:
namespaces:
- n8n
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
---
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-nextcloud-access
namespace: nextcloud
spec:
action: ALLOW
rules:
# Intra-namespace (nextcloud ↔ mariadb ↔ redis)
- from:
- source:
namespaces:
- nextcloud
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-teslamate-access
namespace: teslamate
spec:
action: ALLOW
rules:
# Intra-namespace (teslamate ↔ postgres)
- from:
- source:
namespaces:
- teslamate
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# Grafana reads TeslaMate postgres directly for dashboards
- from:
- source:
namespaces:
- grafana
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-home-assistant-access
namespace: home-assistant
spec:
action: ALLOW
rules:
# Intra-namespace (HA ↔ ESPHome)
- from:
- source:
namespaces:
- home-assistant
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-frigate-access
namespace: frigate
spec:
action: ALLOW
rules:
# Intra-namespace
- from:
- source:
namespaces:
- frigate
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# Home Assistant accesses Frigate API
- from:
- source:
namespaces:
- home-assistant
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-guacamole-access
namespace: guacamole
spec:
action: ALLOW
rules:
# Intra-namespace (guacamole ↔ guacd ↔ postgres)
- from:
- source:
namespaces:
- guacamole
# CNPG operator managing database instances
- from:
- source:
namespaces:
- cnpg-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
---
# --- Nessus: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-nessus-access
namespace: nessus
spec:
action: ALLOW
rules:
# Intra-namespace
- from:
- source:
namespaces:
- nessus
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus
---
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: allow-rancher-access
namespace: cattle-system
spec:
action: ALLOW
rules:
# Intra-namespace (rancher + fleet + webhook)
- from:
- source:
namespaces:
- cattle-system
- from:
- source:
namespaces:
- istio-system
- from:
- source:
namespaces:
- prometheus