mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Opus 4.6
f8eea2ed45
Remove all nessus references: ArgoCD project destination, Istio ambient enrollment, waypoint gateway, authorization policies, ext-authz policy, TLS certificate, ingress gateway host, Kyverno exclusion, and Authentik forward-auth blueprint. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
299 lines
7.1 KiB
YAML
299 lines
7.1 KiB
YAML
# ==========================================================================
|
|
# Application Namespace Authorization Policies
|
|
# ==========================================================================
|
|
#
|
|
# These ALLOW policies permit the Istio ingress gateway (istio-system),
|
|
# Prometheus, and intra-namespace traffic to reach application workloads.
|
|
#
|
|
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
|
|
# intra-namespace. Each policy must explicitly allow same-namespace
|
|
# communication for pods to reach their own databases, caches, etc.
|
|
#
|
|
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
|
|
# ==========================================================================
|
|
|
|
# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-argocd-access
|
|
namespace: argocd
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-gitlab-access
|
|
namespace: gitlab
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- gitlab
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# ArgoCD pulls from GitLab repos
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
# Redis operator managing Redis instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- redis-operator
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-n8n-access
|
|
namespace: n8n
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (n8n ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- n8n
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
|
|
---
|
|
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-nextcloud-access
|
|
namespace: nextcloud
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (nextcloud ↔ mariadb ↔ redis)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- nextcloud
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-teslamate-access
|
|
namespace: teslamate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (teslamate ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- teslamate
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Grafana reads TeslaMate postgres directly for dashboards
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- grafana
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-home-assistant-access
|
|
namespace: home-assistant
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (HA ↔ ESPHome)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-frigate-access
|
|
namespace: frigate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- frigate
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Home Assistant accesses Frigate API
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-guacamole-access
|
|
namespace: guacamole
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (guacamole ↔ guacd ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- guacamole
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-rancher-access
|
|
namespace: cattle-system
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (rancher + fleet + webhook)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cattle-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|