mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Initial commit
This commit is contained in:
Scooby Husky
@@ -0,0 +1,67 @@
|
||||
# ==========================================================================
|
||||
# Global Authentik ext_authz Policy - Ingress Gateway
|
||||
# ==========================================================================
|
||||
#
|
||||
# This CUSTOM AuthorizationPolicy runs on the Istio ingress gateway and
|
||||
# requires Authentik forward-auth for ALL external traffic, EXCEPT:
|
||||
#
|
||||
# 1. auth.kube.huskypup.net - Authentik itself (must be reachable)
|
||||
# 2. Services with native OIDC - They redirect to Authentik themselves
|
||||
# 3. Machine-access services - Docker registry, git agent, MQTT, etc.
|
||||
# 4. Vault - Has its own auth system
|
||||
#
|
||||
# How it works:
|
||||
# - The ingress gateway is a regular Envoy proxy (not ztunnel), so CUSTOM
|
||||
# action works directly without waypoint proxies.
|
||||
# - Unauthenticated users get HTTP 302 redirect to Authentik login.
|
||||
# - After login, Authentik sets a session cookie and redirects back.
|
||||
# - Subsequent requests pass ext_authz automatically via cookie.
|
||||
#
|
||||
# Zero-trust: Any new *.kube.huskypup.net service is AUTOMATICALLY protected.
|
||||
# To exclude a new native-OIDC service, add its hostname to notValues below.
|
||||
#
|
||||
# Per-namespace ext_authz policies in ext-authz-policies.yaml provide
|
||||
# defense-in-depth at the waypoint proxy layer.
|
||||
# ==========================================================================
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: global-authentik-authz
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
istio: ingressgateway
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: "authentik-ext-authz" # Must match meshConfig extensionProviders[].name
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts: ["*.kube.huskypup.net"]
|
||||
when:
|
||||
- key: request.headers[host]
|
||||
notValues:
|
||||
# --- Authentik itself (must be reachable to log in) ---
|
||||
- "auth.kube.huskypup.net"
|
||||
|
||||
# --- Services with native Authentik OIDC (handle auth themselves) ---
|
||||
- "grafana.kube.huskypup.net"
|
||||
- "argocd.kube.huskypup.net"
|
||||
- "gitlab.kube.huskypup.net"
|
||||
- "n8n.kube.huskypup.net"
|
||||
- "nextcloud.kube.huskypup.net"
|
||||
- "homeassistant.kube.huskypup.net"
|
||||
- "guacamole.kube.huskypup.net"
|
||||
- "rancher.kube.huskypup.net"
|
||||
- "netbird.kube.huskypup.net"
|
||||
- "everest.kube.huskypup.net"
|
||||
|
||||
# --- Machine-access services (ext_authz would break automation) ---
|
||||
- "registry.gitlab.kube.huskypup.net" # Docker registry (docker push/pull)
|
||||
- "minio.gitlab.kube.huskypup.net" # Object storage (CI artifacts)
|
||||
- "kas.kube.huskypup.net" # GitLab Agent Server (cluster agent)
|
||||
- "mqtt.kube.huskypup.net" # MQTT protocol (IoT devices)
|
||||
|
||||
# --- Vault (has its own auth system + API access by ESO/apps) ---
|
||||
- "vault.kube.huskypup.net"
|
||||
@@ -0,0 +1,363 @@
|
||||
# ==========================================================================
|
||||
# Zero Trust Authorization Policies - Deny by Default, Allow Explicitly
|
||||
# ==========================================================================
|
||||
#
|
||||
# Policy hierarchy:
|
||||
# 1. Mesh-wide DENY (default - everything blocked)
|
||||
# 2. Ingress Gateway ALLOW (external traffic entry point)
|
||||
# 3. Service-to-service ALLOW (explicit inter-service communication)
|
||||
# 4. Monitoring ALLOW (Prometheus scraping, Kiali queries)
|
||||
#
|
||||
# In ambient mode, L7 policies are enforced by waypoint proxies in each
|
||||
# namespace. L4 policies (source namespace/principal) are enforced by ztunnel.
|
||||
# Each namespace with ALLOW/CUSTOM policies must have a waypoint Gateway.
|
||||
# ==========================================================================
|
||||
|
||||
# --- Ingress Gateway: Allow all external traffic through the edge gateway ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-ingress-gateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
istio: ingressgateway
|
||||
action: ALLOW
|
||||
rules:
|
||||
- {}
|
||||
|
||||
---
|
||||
# --- Allow Prometheus to scrape Istio control plane + gateway metrics ---
|
||||
# Selector scopes this to istio-system workloads only.
|
||||
# Without a selector, policies in the root namespace (istio-system) apply
|
||||
# mesh-wide in ambient mode, creating implicit deny for all ambient workloads.
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-scraping
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/part-of: istio
|
||||
action: ALLOW
|
||||
rules:
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
to:
|
||||
- operation:
|
||||
ports:
|
||||
- "15014" # istiod control plane metrics
|
||||
- "15020" # sidecar/gateway merged metrics
|
||||
- "15090" # Envoy admin metrics
|
||||
|
||||
---
|
||||
# --- Allow Kiali to query istiod ---
|
||||
# Selector scopes this to istiod only (ambient root namespace caveat above).
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-kiali
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: istiod
|
||||
action: ALLOW
|
||||
rules:
|
||||
- from:
|
||||
- source:
|
||||
principals:
|
||||
- cluster.local/ns/istio-system/sa/kiali-service-account
|
||||
|
||||
---
|
||||
# --- Authentik: Allow traffic from ingress + apps doing OIDC ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-authentik-access
|
||||
namespace: authentik
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace (server ↔ worker ↔ postgres)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- authentik
|
||||
# CNPG operator managing database instances
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- cnpg-system
|
||||
# Ingress gateway for browser flows
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
# Apps doing OIDC token exchange
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- argocd
|
||||
- gitlab
|
||||
- grafana
|
||||
- nextcloud
|
||||
- home-assistant
|
||||
- guacamole
|
||||
- netbird
|
||||
- cattle-system
|
||||
- frigate
|
||||
- teslamate
|
||||
# Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- Grafana: Allow ingress + Prometheus datasource queries + scraping ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-grafana-access
|
||||
namespace: grafana
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- grafana
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
||||
- from:
|
||||
- source:
|
||||
ipBlocks:
|
||||
- "10.244.0.0/16"
|
||||
|
||||
---
|
||||
# --- Prometheus: Allow ingress + self-scraping + Grafana ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-prometheus-access
|
||||
namespace: prometheus
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace (Prometheus ↔ alertmanager ↔ node-exporter)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
- grafana
|
||||
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
||||
- from:
|
||||
- source:
|
||||
ipBlocks:
|
||||
- "10.244.0.0/16"
|
||||
|
||||
---
|
||||
# --- MQTT: Allow Home Assistant + Frigate + ESPHome + Prometheus ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-mqtt-access
|
||||
namespace: mqtt
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- mqtt
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
- home-assistant
|
||||
- frigate
|
||||
- teslamate
|
||||
# Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- External DNS: Allow internal access + Prometheus ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-external-dns
|
||||
namespace: external-dns
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- external-dns
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
# Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- Unpoller: Allow Prometheus scraping ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-unpoller-access
|
||||
namespace: unpoller
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- unpoller
|
||||
# Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- Netbird: Allow ingress + Prometheus ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-netbird-access
|
||||
namespace: netbird
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- netbird
|
||||
# CNPG operator managing database instances
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- cnpg-system
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
# Netbird operator querying management API
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- netbird-operator
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- Netbird Operator: Allow intra-namespace + Prometheus ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-netbird-operator-access
|
||||
namespace: netbird-operator
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- netbird-operator
|
||||
# Prometheus scraping (L4-only)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
|
||||
---
|
||||
# --- CrowdSec: Allow intra-namespace + CNPG + Prometheus ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-crowdsec-access
|
||||
namespace: crowdsec
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace (LAPI <-> agent)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- crowdsec
|
||||
# CNPG operator managing database instances
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- cnpg-system
|
||||
# Prometheus scraping (L4-only; L7 path checks deferred to waypoint)
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
# Firewall bouncer (hostNetwork DaemonSet) connects from node IPs
|
||||
- from:
|
||||
- source:
|
||||
ipBlocks:
|
||||
- "172.28.101.0/24"
|
||||
|
||||
---
|
||||
# --- Scylla Manager: Allow ingress + Prometheus + intra-namespace ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-scylla-manager-access
|
||||
namespace: scylla-manager
|
||||
spec:
|
||||
action: ALLOW
|
||||
rules:
|
||||
# Intra-namespace
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- scylla-manager
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- istio-system
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- prometheus
|
||||
# Scylla operator managing clusters
|
||||
- from:
|
||||
- source:
|
||||
namespaces:
|
||||
- scylla-operator
|
||||
@@ -0,0 +1,139 @@
|
||||
# ==========================================================================
|
||||
# Istio ext_authz Policies - Forward Auth via Authentik
|
||||
# ==========================================================================
|
||||
#
|
||||
# These policies protect services that don't have native OIDC integration.
|
||||
# Istio's ext_authz filter calls Authentik's forward-auth endpoint before
|
||||
# allowing traffic through.
|
||||
#
|
||||
# Services with native OIDC (GitLab, ArgoCD, Grafana, n8n, Home Assistant,
|
||||
# Rancher, Nextcloud) do NOT need ext_authz - they handle auth themselves.
|
||||
#
|
||||
# IMPORTANT: CUSTOM action does NOT support 'from' or source-based matching.
|
||||
# We use 'to.operation.hosts' to restrict to external hostnames only.
|
||||
# Internal service-to-service traffic uses k8s DNS names (*.svc.cluster.local)
|
||||
# which won't match, so it bypasses ext_authz and hits ALLOW policies instead.
|
||||
# ==========================================================================
|
||||
|
||||
# --- Prometheus: Require Authentik auth for browser access ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-prometheus
|
||||
namespace: prometheus
|
||||
spec:
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- prometheus.kube.huskypup.net
|
||||
paths:
|
||||
- /*
|
||||
---
|
||||
# --- TeslaMate: Require Authentik auth ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-teslamate
|
||||
namespace: teslamate
|
||||
spec:
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- teslamate.kube.huskypup.net
|
||||
---
|
||||
# --- ESPHome: Require Authentik auth ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-esphome
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: esphome
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- esphome.kube.huskypup.net
|
||||
---
|
||||
# --- Kiali: Require Authentik auth ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-kiali
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kiali
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- kiali.kube.huskypup.net
|
||||
---
|
||||
# --- Frigate: Require Authentik auth ---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-frigate
|
||||
namespace: frigate
|
||||
spec:
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- frigate.kube.huskypup.net
|
||||
---
|
||||
# --- Scylla Manager: Require Authentik auth ---
|
||||
# NOTE: Namespace 'scylla-manager' must exist before applying this policy.
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-scylla-manager
|
||||
namespace: scylla-manager
|
||||
spec:
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- scylla-manager.kube.huskypup.net
|
||||
---
|
||||
# --- Nessus: Require Authentik auth ---
|
||||
# NOTE: Namespace 'nessus' must exist before applying this policy.
|
||||
# This policy will be skipped if the namespace doesn't exist yet.
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: ext-authz-nessus
|
||||
namespace: nessus
|
||||
spec:
|
||||
action: CUSTOM
|
||||
provider:
|
||||
name: authentik-ext-authz
|
||||
rules:
|
||||
- to:
|
||||
- operation:
|
||||
hosts:
|
||||
- nessus.kube.huskypup.net
|
||||
@@ -0,0 +1,68 @@
|
||||
# Istio Ambient Prometheus Monitors
|
||||
# Required for Kiali to display traffic graphs
|
||||
#
|
||||
# PodMonitor (ztunnel): Scrapes ztunnel L4 metrics from all nodes
|
||||
# PodMonitor (waypoint): Scrapes waypoint proxy L7 metrics
|
||||
# ServiceMonitor (istiod): Scrapes istiod control plane metrics
|
||||
#
|
||||
# All require label 'release: kube-prometheus-stack' to be picked up
|
||||
# by the Prometheus Operator's selector.
|
||||
---
|
||||
# ztunnel metrics - L4 mTLS traffic metrics from ambient mesh
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: ztunnel
|
||||
namespace: istio-system
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ztunnel
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- istio-system
|
||||
podMetricsEndpoints:
|
||||
- path: /stats/prometheus
|
||||
port: http-monitoring
|
||||
interval: 30s
|
||||
---
|
||||
# Waypoint proxy metrics - L7 AuthorizationPolicy + ext_authz metrics
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: istio-waypoint
|
||||
namespace: istio-system
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
spec:
|
||||
selector:
|
||||
matchExpressions:
|
||||
- key: gateway.networking.k8s.io/gateway-name
|
||||
operator: Exists
|
||||
namespaceSelector:
|
||||
any: true
|
||||
podMetricsEndpoints:
|
||||
- path: /stats/prometheus
|
||||
port: http-envoy-prom
|
||||
interval: 30s
|
||||
---
|
||||
# istiod control plane metrics (unchanged from sidecar mode)
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: istio-system
|
||||
labels:
|
||||
release: kube-prometheus-stack
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
istio: pilot
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- istio-system
|
||||
endpoints:
|
||||
- port: http-monitoring
|
||||
interval: 30s
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: istio-mesh-infra-enrollment
|
||||
namespace: istio-system
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
argocd.argoproj.io/sync-wave: "1"
|
||||
spec:
|
||||
backoffLimit: 3
|
||||
ttlSecondsAfterFinished: 300
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: argocd-hook-sa
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: enroll
|
||||
image: bitnami/kubectl:1.29
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
set -euo pipefail
|
||||
echo "=== Enrolling infrastructure namespaces in Istio ambient mesh ==="
|
||||
|
||||
# Enroll infrastructure namespaces
|
||||
# Excluded: vault (Shamir seal requires manual unseal after restart)
|
||||
# Excluded: kube-system, istio-system, cert-manager, kyverno (system namespaces)
|
||||
INFRA_NAMESPACES=(authentik cnpg-system redis-operator mariadb-system prometheus external-dns grafana mqtt unpoller netbird default gateway scylla-manager crowdsec)
|
||||
for ns in "${INFRA_NAMESPACES[@]}"; do
|
||||
echo "Enrolling $ns in ambient mesh..."
|
||||
kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
|
||||
kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
|
||||
done
|
||||
|
||||
# Attach waypoint proxies for L7 policy enforcement
|
||||
echo "Attaching waypoint proxies to infrastructure namespaces..."
|
||||
WAYPOINT_NAMESPACES=(authentik external-dns grafana mqtt unpoller netbird prometheus scylla-manager crowdsec)
|
||||
for ns in "${WAYPOINT_NAMESPACES[@]}"; do
|
||||
kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
|
||||
done
|
||||
|
||||
# Deploy ext_authz Host-rewriting proxy for Authentik
|
||||
if [ -f /tmp/ext-authz-proxy.yaml ]; then
|
||||
kubectl apply -f /tmp/ext-authz-proxy.yaml
|
||||
fi
|
||||
|
||||
echo "Infrastructure namespace enrollment complete"
|
||||
@@ -0,0 +1,44 @@
|
||||
# PeerAuthentication PERMISSIVE for namespaces that receive non-mesh traffic
|
||||
# The API server calls webhooks from outside the mesh (no SPIFFE identity).
|
||||
# The CrowdSec firewall bouncer runs on hostNetwork (no mesh identity)
|
||||
# and must connect to LAPI over plaintext.
|
||||
# PERMISSIVE allows both mTLS and plaintext inbound.
|
||||
---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: allow-apiserver-webhooks
|
||||
namespace: cnpg-system
|
||||
spec:
|
||||
mtls:
|
||||
mode: PERMISSIVE
|
||||
---
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: allow-apiserver-webhooks
|
||||
namespace: mariadb-system
|
||||
spec:
|
||||
mtls:
|
||||
mode: PERMISSIVE
|
||||
---
|
||||
# Netbird operator webhook receives calls from the API server
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: allow-apiserver-webhooks
|
||||
namespace: netbird-operator
|
||||
spec:
|
||||
mtls:
|
||||
mode: PERMISSIVE
|
||||
---
|
||||
# CrowdSec firewall bouncer (hostNetwork DaemonSet) connects to LAPI
|
||||
# from the host network namespace without a mesh identity
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: allow-hostnetwork-bouncer
|
||||
namespace: crowdsec
|
||||
spec:
|
||||
mtls:
|
||||
mode: PERMISSIVE
|
||||
@@ -0,0 +1,12 @@
|
||||
# Mesh-wide STRICT mTLS - Zero Trust
|
||||
# All service-to-service communication must present valid SPIFFE SVID
|
||||
# In ambient mode, ztunnel enforces mTLS for all enrolled namespaces
|
||||
# Services outside the ambient mesh will be rejected
|
||||
apiVersion: security.istio.io/v1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: default
|
||||
namespace: istio-system
|
||||
spec:
|
||||
mtls:
|
||||
mode: STRICT
|
||||
@@ -0,0 +1,279 @@
|
||||
# Istio Ambient Waypoint Proxies
|
||||
# In ambient mode, L7 AuthorizationPolicies (ALLOW/CUSTOM/ext_authz) are enforced
|
||||
# by waypoint proxies, not sidecars. Each namespace with L7 policies needs a waypoint.
|
||||
#
|
||||
# Waypoints are deployed as Kubernetes Gateway resources using the istio-waypoint
|
||||
# gateway class. They handle:
|
||||
# - L7 AuthorizationPolicy evaluation
|
||||
# - ext_authz calls to Authentik for forward-auth
|
||||
# - HTTP header-based routing decisions
|
||||
|
||||
# --- Infrastructure namespaces ---
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: istio-system
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: authentik
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: grafana
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: prometheus
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: mqtt
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: external-dns
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: unpoller
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: netbird
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
|
||||
# --- Application namespaces ---
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: argocd
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: gitlab
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: n8n
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: nextcloud
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: teslamate
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: home-assistant
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: frigate
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: guacamole
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: nessus
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: crowdsec
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: waypoint
|
||||
namespace: scylla-manager
|
||||
labels:
|
||||
istio.io/waypoint-for: service
|
||||
spec:
|
||||
gatewayClassName: istio-waypoint
|
||||
listeners:
|
||||
- name: mesh
|
||||
port: 15008
|
||||
protocol: HBONE
|
||||
Reference in New Issue
Block a user