# ==========================================================================
# Application Namespace Authorization Policies
# ==========================================================================
#
# These ALLOW policies permit the Istio ingress gateway (istio-system),
# Prometheus, and intra-namespace traffic to reach application workloads.
#
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
# intra-namespace. Each policy must explicitly allow same-namespace
# communication for pods to reach their own databases, caches, etc.
#
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
# ==========================================================================

# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-argocd-access
  namespace: argocd
spec:
  action: ALLOW
  rules:
    # Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
    - from:
        - source:
            namespaces:
              - argocd
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-gitlab-access
  namespace: gitlab
spec:
  action: ALLOW
  rules:
    # Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
    - from:
        - source:
            namespaces:
              - gitlab
    # CNPG operator managing database instances
    - from:
        - source:
            namespaces:
              - cnpg-system
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # ArgoCD pulls from GitLab repos
    - from:
        - source:
            namespaces:
              - argocd
    # Redis operator managing Redis instances
    - from:
        - source:
            namespaces:
              - redis-operator
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-n8n-access
  namespace: n8n
spec:
  action: ALLOW
  rules:
    # Intra-namespace (n8n ↔ postgres)
    - from:
        - source:
            namespaces:
              - n8n
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus

---
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-nextcloud-access
  namespace: nextcloud
spec:
  action: ALLOW
  rules:
    # Intra-namespace (nextcloud ↔ mariadb ↔ redis)
    - from:
        - source:
            namespaces:
              - nextcloud
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-teslamate-access
  namespace: teslamate
spec:
  action: ALLOW
  rules:
    # Intra-namespace (teslamate ↔ postgres)
    - from:
        - source:
            namespaces:
              - teslamate
    # CNPG operator managing database instances
    - from:
        - source:
            namespaces:
              - cnpg-system
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # Grafana reads TeslaMate postgres directly for dashboards
    - from:
        - source:
            namespaces:
              - grafana
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-home-assistant-access
  namespace: home-assistant
spec:
  action: ALLOW
  rules:
    # Intra-namespace (HA ↔ ESPHome)
    - from:
        - source:
            namespaces:
              - home-assistant
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-frigate-access
  namespace: frigate
spec:
  action: ALLOW
  rules:
    # Intra-namespace
    - from:
        - source:
            namespaces:
              - frigate
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # Home Assistant accesses Frigate API
    - from:
        - source:
            namespaces:
              - home-assistant
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-guacamole-access
  namespace: guacamole
spec:
  action: ALLOW
  rules:
    # Intra-namespace (guacamole ↔ guacd ↔ postgres)
    - from:
        - source:
            namespaces:
              - guacamole
    # CNPG operator managing database instances
    - from:
        - source:
            namespaces:
              - cnpg-system
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus
    # NetBird VPN cluster routers (non-mesh, use ipBlocks)
    - from:
        - source:
            ipBlocks:
              - "10.244.0.0/16"

---
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-rancher-access
  namespace: cattle-system
spec:
  action: ALLOW
  rules:
    # Intra-namespace (rancher + fleet + webhook)
    - from:
        - source:
            namespaces:
              - cattle-system
    - from:
        - source:
            namespaces:
              - istio-system
    - from:
        - source:
            namespaces:
              - prometheus