# Baseline CiliumNetworkPolicies for critical infrastructure namespaces
# Provides L3/L4 ingress segmentation (Istio waypoints handle L7)
#
# IMPORTANT: CiliumNetworkPolicy egress rules with empty `{}` only match
# Cilium-managed endpoints — NOT kube-apiserver, host, remote-node, or world.
# Omit egress rules entirely to allow all egress (default behavior).
# Ingress rules must explicitly include fromEntities for host/kube-apiserver
# traffic (health probes, API server webhooks, kubelet).

# --- Vault: Only accessible from ESO, authentik sync scripts, and Prometheus ---
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: vault-ingress
  namespace: vault
spec:
  endpointSelector: {}
  ingress:
    # Kubernetes API server and kubelet (health probes, webhooks)
    - fromEntities:
        - host
        - kube-apiserver
        - remote-node
    # Ingress gateways
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: istio-system
            istio: ingressgateway
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: envoy-gateway-system
    # External Secrets Operator
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: external-secrets
    # Prometheus scraping
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: prometheus
    # Vault internal (raft replication)
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: vault

# --- Authentik: Accessible from ingress, apps doing OIDC, and Prometheus ---
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: authentik-ingress
  namespace: authentik
spec:
  endpointSelector: {}
  ingress:
    # Kubernetes API server and kubelet (health probes, webhooks)
    - fromEntities:
        - host
        - kube-apiserver
        - remote-node
    # Ingress gateways
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: istio-system
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: envoy-gateway-system
    # Internal authentik traffic (server <-> worker, pg access)
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: authentik
    # Apps doing OIDC token exchange
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: argocd
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: gitlab
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: grafana
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: n8n
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: nextcloud
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: home-assistant
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: guacamole
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: netbird
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: cattle-system
    # Prometheus scraping
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: prometheus

# --- CrowdSec: LAPI + agent + Prometheus + CNPG ---
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: crowdsec-ingress
  namespace: crowdsec
spec:
  endpointSelector: {}
  ingress:
    # Kubernetes API server and kubelet (health probes, webhooks)
    - fromEntities:
        - host
        - kube-apiserver
        - remote-node
    # Intra-namespace (LAPI <-> agent)
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: crowdsec
    # CNPG operator
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: cnpg-system
    # Prometheus scraping
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: prometheus

# --- Rook-Ceph: Only internal + Prometheus + CSI consumers ---
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: rook-ceph-ingress
  namespace: rook-ceph
spec:
  endpointSelector: {}
  ingress:
    # Kubernetes API server and kubelet (health probes, webhooks, CSI mounts)
    - fromEntities:
        - host
        - kube-apiserver
        - remote-node
    # Ingress gateways (Ceph dashboard)
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: istio-system
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: envoy-gateway-system
    # Internal Ceph traffic
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: rook-ceph
    # Prometheus scraping
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: prometheus
    # CSI consumers (any namespace can mount Ceph volumes via CSI)
    - fromEndpoints:
        - {}