# Allow ztunnel's HBONE tunnel port (15008) cluster-wide.
#
# Istio ambient mode routes ALL pod-to-pod traffic through ztunnel's mTLS
# HBONE tunnel on port 15008 first, regardless of which "real" port the
# traffic is ultimately for. Per-namespace CiliumNetworkPolicies that only
# allow the application port (e.g. 6379 for Redis, 8000 for CNPG's instance
# status API) block the HBONE tunnel itself even when the intended port is
# allowed - ztunnel's own encrypted connection never gets through.
#
# Hit this same bug twice in one session (2026-08-17): argocd-redis (fixed
# with a namespace-scoped NetworkPolicy) and cnpg-system -> pg-authentik's
# status port (fixed the same way first, still broken - needed this too).
# Rather than keep discovering and patching this per-namespace, allow HBONE
# broadly: ztunnel already enforces real security here via mTLS + SPIFFE
# identity verification (and any CiliumNetworkPolicy/AuthorizationPolicy
# ingress rules on the target still apply to the traffic's real intent) -
# Cilium blocking the tunnel port itself only breaks legitimate mesh traffic,
# it doesn't add a meaningful security boundary on top of what ztunnel
# already does.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-hbone
spec:
  description: "Allows Istio ambient's ztunnel HBONE tunnel port cluster-wide - see comments"
  enableDefaultDeny:
    egress: false
    ingress: false
  endpointSelector: {}
  ingress:
    - toPorts:
        - ports:
            - port: "15008"
              protocol: TCP