mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
166ff0ffb7
Per-pod NodePort Services for the 3 existing Gitaly nodes (ha-gitaly-nodeport.yaml) plus home's Rails internal API (ha-gitlab-internal-api-nodeport.yaml, needed for gitlab-shell hooks whenever the VPS node is primary for a repo). PeerAuthentication PERMISSIVE + AuthorizationPolicy port rules for both, matching the proven Postgres pattern. CoreDNS rewrites so home's own Praefect resolves the floating hostnames locally instead of round-tripping. Reached over the Netbird mesh, not the UniFi WAN forward used for Postgres - Gitaly gRPC here is plaintext (carries the gitaly_token, gitlab_shell_secret, and raw repo contents), unlike CNPG's TLS-negotiated stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
329 lines
8.8 KiB
YAML
329 lines
8.8 KiB
YAML
# ==========================================================================
|
|
# Application Namespace Authorization Policies
|
|
# ==========================================================================
|
|
#
|
|
# These ALLOW policies permit the Istio ingress gateway (istio-system),
|
|
# Prometheus, and intra-namespace traffic to reach application workloads.
|
|
#
|
|
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
|
|
# intra-namespace. Each policy must explicitly allow same-namespace
|
|
# communication for pods to reach their own databases, caches, etc.
|
|
#
|
|
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
|
|
# ==========================================================================
|
|
|
|
# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-argocd-access
|
|
namespace: argocd
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-gitlab-access
|
|
namespace: gitlab
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- gitlab
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# ArgoCD pulls from GitLab repos
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
# Redis operator managing Redis instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- redis-operator
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
# GitLab cross-site replication (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md): CNPG
|
|
# streaming replication from the VPS/witness, arriving via the
|
|
# ha-gitlab-postgres/ha-praefect-postgres NodePorts - no mesh
|
|
# identity at all, so no source.namespaces rule above can match them.
|
|
# Scoped by destination port instead, matching the port-scoped
|
|
# PERMISSIVE PeerAuthentication in ha-peerauth.yaml (same root cause,
|
|
# same fix, one layer up - mTLS being allowed through isn't enough by
|
|
# itself, this ALLOW policy independently denies anything not
|
|
# matching one of the rules above). Same pattern already proven for
|
|
# Authentik in infrastructure/istio/manifests/mesh/authorization-policies.yaml.
|
|
- to:
|
|
- operation:
|
|
ports:
|
|
- "5432"
|
|
- "61442" # pg-gitlab floating-hostname port, see ha-postgres-nodeport.yaml
|
|
- "61443" # pg-praefect floating-hostname port, see ha-postgres-nodeport.yaml
|
|
- "8075" # Gitaly gRPC, see ha-gitaly-nodeport.yaml
|
|
- "8181" # Rails internal API, see ha-gitlab-internal-api-nodeport.yaml
|
|
|
|
---
|
|
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-n8n-access
|
|
namespace: n8n
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (n8n ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- n8n
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# CNPG operator (cnpg-system) polling pg-n8n instances' status API
|
|
# (port 8000). Missing here despite being needed for the exact same
|
|
# reason as authentik/nextcloud/crowdsec - found 2026-08-17: this was
|
|
# the actual cause of pg-n8n's long-recurring "Instance Status
|
|
# Extraction Error" (100% reproducible connection resets from
|
|
# cnpg-system, not the intermittent HBONE-tunnel issue it looked like
|
|
# from the outside). Matches nextcloud's broader ipBlocks fallback.
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-nextcloud-access
|
|
namespace: nextcloud
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (nextcloud ↔ mariadb ↔ redis)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- nextcloud
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-teslamate-access
|
|
namespace: teslamate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (teslamate ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- teslamate
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Grafana reads TeslaMate postgres directly for dashboards
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- grafana
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-home-assistant-access
|
|
namespace: home-assistant
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (HA ↔ ESPHome)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-frigate-access
|
|
namespace: frigate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- frigate
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Home Assistant accesses Frigate API
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-guacamole-access
|
|
namespace: guacamole
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (guacamole ↔ guacd ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- guacamole
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-rancher-access
|
|
namespace: cattle-system
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (rancher + fleet + webhook)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cattle-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|