mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
04fa80ece3
Per the approved plan (jiggly-snacking-iverson.md, 'GitLab True Cross-Site Replication' section) - replacing the git-mirror CronJob with real CNPG streaming replication for pg-gitlab and pg-praefect, reusing the exact pattern already proven for pg-authentik. This commit is network plumbing only, no DB replication yet: - Repoint both CNPG clusters' barmanObjectStore backup target from in-cluster gitlab-minio-svc to VPS MinIO (also becomes the initial seed source for the VPS's replicas in Phase 1c). - New ha-gitlab-postgres/ha-praefect-postgres NodePort Services (bypass CNPG's own -rw Services) on both home and VPS. - New PeerAuthentication with portLevelMtls PERMISSIVE on the replication ports - ambient mesh STRICT default would otherwise reset the VPS/witness's connection before the Postgres TLS handshake starts. - Extended allow-gitlab-access AuthorizationPolicy with a port-scoped rule for the same traffic (no source.namespaces rule can match external, non-mesh peers). - CoreDNS rewrites for pg-gitlab.ha.huskypup.net / pg-praefect.ha.huskypup.net so home's own pods reach the floating hostname locally instead of round-tripping through the WAN forward (no NAT hairpin support). Still needed before Phase 1b/1c: UniFi WAN port-forwards for external ports 61442/61443 -> talos-cp-01:32442/32443, source-restricted to the VPS + witness public IPs (manual, same as the existing 61432 rule). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
327 lines
8.7 KiB
YAML
327 lines
8.7 KiB
YAML
# ==========================================================================
|
|
# Application Namespace Authorization Policies
|
|
# ==========================================================================
|
|
#
|
|
# These ALLOW policies permit the Istio ingress gateway (istio-system),
|
|
# Prometheus, and intra-namespace traffic to reach application workloads.
|
|
#
|
|
# In ambient mode, ztunnel enforces L4 policies on ALL traffic including
|
|
# intra-namespace. Each policy must explicitly allow same-namespace
|
|
# communication for pods to reach their own databases, caches, etc.
|
|
#
|
|
# Applied by: apps/helmfile.yaml istio-app-routes postsync hook
|
|
# ==========================================================================
|
|
|
|
# --- ArgoCD: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-argocd-access
|
|
namespace: argocd
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (server ↔ repo-server ↔ redis ↔ controller)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- GitLab: Allow ingress + Prometheus + ArgoCD + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-gitlab-access
|
|
namespace: gitlab
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (webservice ↔ gitaly ↔ redis ↔ postgres ↔ sidekiq ↔ praefect)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- gitlab
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# ArgoCD pulls from GitLab repos
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- argocd
|
|
# Redis operator managing Redis instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- redis-operator
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
# GitLab cross-site replication (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md): CNPG
|
|
# streaming replication from the VPS/witness, arriving via the
|
|
# ha-gitlab-postgres/ha-praefect-postgres NodePorts - no mesh
|
|
# identity at all, so no source.namespaces rule above can match them.
|
|
# Scoped by destination port instead, matching the port-scoped
|
|
# PERMISSIVE PeerAuthentication in ha-peerauth.yaml (same root cause,
|
|
# same fix, one layer up - mTLS being allowed through isn't enough by
|
|
# itself, this ALLOW policy independently denies anything not
|
|
# matching one of the rules above). Same pattern already proven for
|
|
# Authentik in infrastructure/istio/manifests/mesh/authorization-policies.yaml.
|
|
- to:
|
|
- operation:
|
|
ports:
|
|
- "5432"
|
|
- "61442" # pg-gitlab floating-hostname port, see ha-postgres-nodeport.yaml
|
|
- "61443" # pg-praefect floating-hostname port, see ha-postgres-nodeport.yaml
|
|
|
|
---
|
|
# --- n8n: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-n8n-access
|
|
namespace: n8n
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (n8n ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- n8n
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# CNPG operator (cnpg-system) polling pg-n8n instances' status API
|
|
# (port 8000). Missing here despite being needed for the exact same
|
|
# reason as authentik/nextcloud/crowdsec - found 2026-08-17: this was
|
|
# the actual cause of pg-n8n's long-recurring "Instance Status
|
|
# Extraction Error" (100% reproducible connection resets from
|
|
# cnpg-system, not the intermittent HBONE-tunnel issue it looked like
|
|
# from the outside). Matches nextcloud's broader ipBlocks fallback.
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-nextcloud-access
|
|
namespace: nextcloud
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (nextcloud ↔ mariadb ↔ redis)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- nextcloud
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- TeslaMate: Allow ingress + Prometheus + Grafana + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-teslamate-access
|
|
namespace: teslamate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (teslamate ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- teslamate
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Grafana reads TeslaMate postgres directly for dashboards
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- grafana
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Home Assistant: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-home-assistant-access
|
|
namespace: home-assistant
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (HA ↔ ESPHome)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Frigate: Allow ingress + Prometheus + Home Assistant + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-frigate-access
|
|
namespace: frigate
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- frigate
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# Home Assistant accesses Frigate API
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- home-assistant
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Guacamole: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-guacamole-access
|
|
namespace: guacamole
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (guacamole ↔ guacd ↔ postgres)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- guacamole
|
|
# CNPG operator managing database instances
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cnpg-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|
|
# NetBird VPN cluster routers (non-mesh, use ipBlocks)
|
|
- from:
|
|
- source:
|
|
ipBlocks:
|
|
- "10.244.0.0/16"
|
|
|
|
---
|
|
# --- Rancher: Allow ingress + Prometheus + intra-namespace ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: allow-rancher-access
|
|
namespace: cattle-system
|
|
spec:
|
|
action: ALLOW
|
|
rules:
|
|
# Intra-namespace (rancher + fleet + webhook)
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- cattle-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- istio-system
|
|
- from:
|
|
- source:
|
|
namespaces:
|
|
- prometheus
|