diff --git a/add-ons/authentik/kustomization.yaml b/add-ons/authentik/kustomization.yaml index 2efeede..edcba9a 100644 --- a/add-ons/authentik/kustomization.yaml +++ b/add-ons/authentik/kustomization.yaml @@ -12,3 +12,4 @@ resources: - blueprint-wireguard-admin.yaml - httproute.yaml - referencegrant.yaml + - networkpolicy.yaml diff --git a/add-ons/authentik/networkpolicy.yaml b/add-ons/authentik/networkpolicy.yaml new file mode 100644 index 0000000..56fdae6 --- /dev/null +++ b/add-ons/authentik/networkpolicy.yaml @@ -0,0 +1,57 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: authentik + namespace: authentik +spec: + egress: + - to: + - podSelector: {} + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 5432 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: postgres + podSelector: + matchLabels: + cnpg.io/cluster: postgres + - ports: + - port: 6443 + protocol: TCP + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - podSelector: {} + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 9000 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: authentik + policyTypes: + - Ingress + - Egress diff --git a/add-ons/postgres/kustomization.yaml b/add-ons/postgres/kustomization.yaml index ac0a0ea..da3a83c 100644 --- a/add-ons/postgres/kustomization.yaml +++ b/add-ons/postgres/kustomization.yaml @@ -9,3 +9,4 @@ resources: - pgweb-db-sealedsecret.yaml - redoost-db-sealedsecret.yaml - redoost-database.yaml + - networkpolicy.yaml diff --git a/add-ons/postgres/networkpolicy.yaml b/add-ons/postgres/networkpolicy.yaml new file mode 100644 index 0000000..b9be9bb --- /dev/null +++ b/add-ons/postgres/networkpolicy.yaml @@ -0,0 +1,72 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: postgres + namespace: postgres +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 6443 + protocol: TCP + - to: + - podSelector: + matchLabels: + cnpg.io/cluster: postgres + ingress: + - from: + - podSelector: + matchLabels: + cnpg.io/cluster: postgres + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: cnpg-system + podSelector: + matchLabels: + app.kubernetes.io/name: cloudnative-pg + ports: + - port: 8000 + protocol: TCP + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: authentik + podSelector: + matchLabels: + app.kubernetes.io/name: authentik + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + podSelector: + matchLabels: + app.kubernetes.io/name: grafana + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: pgweb + podSelector: + matchLabels: + app.kubernetes.io/name: pgweb + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: redoost + ports: + - port: 5432 + protocol: TCP + podSelector: + matchLabels: + cnpg.io/cluster: postgres + policyTypes: + - Ingress + - Egress diff --git a/add-ons/traefik/kustomization.yaml b/add-ons/traefik/kustomization.yaml index 280e75f..bdefb02 100644 --- a/add-ons/traefik/kustomization.yaml +++ b/add-ons/traefik/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - wildcard-whyredfire-dev.yaml - wildcard-whyredfire-dpdns-org.yaml + - networkpolicy.yaml diff --git a/add-ons/traefik/networkpolicy.yaml b/add-ons/traefik/networkpolicy.yaml new file mode 100644 index 0000000..c586141 --- /dev/null +++ b/add-ons/traefik/networkpolicy.yaml @@ -0,0 +1,39 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: traefik + namespace: traefik +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 6443 + protocol: TCP + - to: + - namespaceSelector: {} + ingress: + - from: + - ipBlock: + cidr: 0.0.0.0/0 + ports: + - port: 8000 + protocol: TCP + - port: 8443 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: traefik + policyTypes: + - Ingress + - Egress diff --git a/apps/bentopdf/kustomization.yaml b/apps/bentopdf/kustomization.yaml index 31fd463..0927142 100644 --- a/apps/bentopdf/kustomization.yaml +++ b/apps/bentopdf/kustomization.yaml @@ -4,3 +4,4 @@ resources: - deployment.yaml - service.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/bentopdf/networkpolicy.yaml b/apps/bentopdf/networkpolicy.yaml new file mode 100644 index 0000000..ca58a4a --- /dev/null +++ b/apps/bentopdf/networkpolicy.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: bentopdf + namespace: bentopdf +spec: + egress: [] + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: bentopdf + policyTypes: + - Ingress + - Egress diff --git a/apps/garage-ui/kustomization.yaml b/apps/garage-ui/kustomization.yaml index 8af86c7..b1d76e3 100644 --- a/apps/garage-ui/kustomization.yaml +++ b/apps/garage-ui/kustomization.yaml @@ -4,3 +4,4 @@ resources: - sealed-secret.yaml - middleware.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/garage-ui/networkpolicy.yaml b/apps/garage-ui/networkpolicy.yaml new file mode 100644 index 0000000..9cde915 --- /dev/null +++ b/apps/garage-ui/networkpolicy.yaml @@ -0,0 +1,40 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: garage-ui + namespace: garage +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 3903 + protocol: TCP + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: garage + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: garage-ui + policyTypes: + - Ingress + - Egress diff --git a/apps/garage/kustomization.yaml b/apps/garage/kustomization.yaml index 894f6c8..60de8d4 100644 --- a/apps/garage/kustomization.yaml +++ b/apps/garage/kustomization.yaml @@ -4,3 +4,4 @@ resources: - httproute-s3.yaml - sealed-secret.yaml - service-admin.yaml + - networkpolicy.yaml diff --git a/apps/garage/networkpolicy.yaml b/apps/garage/networkpolicy.yaml new file mode 100644 index 0000000..ea71e6e --- /dev/null +++ b/apps/garage/networkpolicy.yaml @@ -0,0 +1,44 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: garage + namespace: garage +spec: + egress: [] + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: redoost + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + podSelector: + matchLabels: + app.kubernetes.io/name: loki + ports: + - port: 3900 + protocol: TCP + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: redoost + ports: + - port: 3902 + protocol: TCP + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: garage-ui + ports: + - port: 3903 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: garage + policyTypes: + - Ingress + - Egress diff --git a/apps/qbit/kustomization.yaml b/apps/qbit/kustomization.yaml index 6327082..033b4da 100644 --- a/apps/qbit/kustomization.yaml +++ b/apps/qbit/kustomization.yaml @@ -7,3 +7,4 @@ resources: - service.yaml - middleware.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/qbit/networkpolicy.yaml b/apps/qbit/networkpolicy.yaml new file mode 100644 index 0000000..ab2dd6e --- /dev/null +++ b/apps/qbit/networkpolicy.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: qbittorrent + namespace: qbit +spec: + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: qbittorrent + policyTypes: + - Ingress + - Egress diff --git a/apps/rustbin/kustomization.yaml b/apps/rustbin/kustomization.yaml index e1e32aa..d5e7205 100644 --- a/apps/rustbin/kustomization.yaml +++ b/apps/rustbin/kustomization.yaml @@ -5,3 +5,4 @@ resources: - deployment.yaml - service.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/rustbin/networkpolicy.yaml b/apps/rustbin/networkpolicy.yaml new file mode 100644 index 0000000..7c5ee64 --- /dev/null +++ b/apps/rustbin/networkpolicy.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: rustbin + namespace: rustbin +spec: + egress: [] + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 3000 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: rustbin + policyTypes: + - Ingress + - Egress diff --git a/apps/wireguard/kustomization.yaml b/apps/wireguard/kustomization.yaml index 04acdc5..a16ecb0 100644 --- a/apps/wireguard/kustomization.yaml +++ b/apps/wireguard/kustomization.yaml @@ -7,3 +7,4 @@ resources: - service.yaml - service-admin.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/wireguard/networkpolicy.yaml b/apps/wireguard/networkpolicy.yaml new file mode 100644 index 0000000..6525d72 --- /dev/null +++ b/apps/wireguard/networkpolicy.yaml @@ -0,0 +1,48 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: wireguard + namespace: wireguard +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - to: + - ipBlock: + cidr: 192.168.2.0/24 + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - ipBlock: + cidr: 0.0.0.0/0 + ports: + - port: 27299 + protocol: UDP + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 51821 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: wireguard + policyTypes: + - Ingress + - Egress diff --git a/argocd-apps/add-ons/traefik.yaml b/argocd-apps/add-ons/traefik.yaml index 5ed7912..797515f 100644 --- a/argocd-apps/add-ons/traefik.yaml +++ b/argocd-apps/add-ons/traefik.yaml @@ -15,6 +15,9 @@ spec: - chart: traefik helm: values: | + # The network policy allows no internet egress + global: + checkNewVersion: false # Query strings are dropped, as OAuth callbacks carry codes. accessLog: enabled: true diff --git a/argocd-apps/apps/jellyfin.yaml b/argocd-apps/apps/jellyfin.yaml index 9d2dbc1..421eba0 100644 --- a/argocd-apps/apps/jellyfin.yaml +++ b/argocd-apps/apps/jellyfin.yaml @@ -30,6 +30,28 @@ spec: enabled: true type: hostPath hostPath: /srv/media + # Metadata, artwork, and subtitles come from the internet; the + # cluster and the LAN stay off limits + networkPolicy: + enabled: true + ingress: + allowExternal: false + namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + egress: + allowAllEgress: false + restrictedEgress: + allowMetadata: false + allowInCluster: false + customRules: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 resources: limits: cpu: 3000m