From 7467e34b4ca8060814df241d1483da579f33e639 Mon Sep 17 00:00:00 2001 From: Karan Parashar Date: Wed, 28 Oct 2026 15:12:22 +0530 Subject: [PATCH] chore(apps): Add network policies to standalone apps --- apps/bentopdf/kustomization.yaml | 1 + apps/bentopdf/networkpolicy.yaml | 21 ++++++++++++++ apps/garage-ui/kustomization.yaml | 1 + apps/garage-ui/networkpolicy.yaml | 40 ++++++++++++++++++++++++++ apps/qbit/kustomization.yaml | 1 + apps/qbit/networkpolicy.yaml | 28 ++++++++++++++++++ apps/rustbin/kustomization.yaml | 1 + apps/rustbin/networkpolicy.yaml | 21 ++++++++++++++ apps/wireguard/kustomization.yaml | 1 + apps/wireguard/networkpolicy.yaml | 48 +++++++++++++++++++++++++++++++ argocd-apps/apps/jellyfin.yaml | 22 ++++++++++++++ 11 files changed, 185 insertions(+) create mode 100644 apps/bentopdf/networkpolicy.yaml create mode 100644 apps/garage-ui/networkpolicy.yaml create mode 100644 apps/qbit/networkpolicy.yaml create mode 100644 apps/rustbin/networkpolicy.yaml create mode 100644 apps/wireguard/networkpolicy.yaml diff --git a/apps/bentopdf/kustomization.yaml b/apps/bentopdf/kustomization.yaml index 31fd463..0927142 100644 --- a/apps/bentopdf/kustomization.yaml +++ b/apps/bentopdf/kustomization.yaml @@ -4,3 +4,4 @@ resources: - deployment.yaml - service.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/bentopdf/networkpolicy.yaml b/apps/bentopdf/networkpolicy.yaml new file mode 100644 index 0000000..ca58a4a --- /dev/null +++ b/apps/bentopdf/networkpolicy.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: bentopdf + namespace: bentopdf +spec: + egress: [] + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: bentopdf + policyTypes: + - Ingress + - Egress diff --git a/apps/garage-ui/kustomization.yaml b/apps/garage-ui/kustomization.yaml index 8af86c7..b1d76e3 100644 --- a/apps/garage-ui/kustomization.yaml +++ b/apps/garage-ui/kustomization.yaml @@ -4,3 +4,4 @@ resources: - sealed-secret.yaml - middleware.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/garage-ui/networkpolicy.yaml b/apps/garage-ui/networkpolicy.yaml new file mode 100644 index 0000000..9cde915 --- /dev/null +++ b/apps/garage-ui/networkpolicy.yaml @@ -0,0 +1,40 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: garage-ui + namespace: garage +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - ports: + - port: 3903 + protocol: TCP + to: + - podSelector: + matchLabels: + app.kubernetes.io/name: garage + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: garage-ui + policyTypes: + - Ingress + - Egress diff --git a/apps/qbit/kustomization.yaml b/apps/qbit/kustomization.yaml index 6327082..033b4da 100644 --- a/apps/qbit/kustomization.yaml +++ b/apps/qbit/kustomization.yaml @@ -7,3 +7,4 @@ resources: - service.yaml - middleware.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/qbit/networkpolicy.yaml b/apps/qbit/networkpolicy.yaml new file mode 100644 index 0000000..ab2dd6e --- /dev/null +++ b/apps/qbit/networkpolicy.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: qbittorrent + namespace: qbit +spec: + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 8080 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: qbittorrent + policyTypes: + - Ingress + - Egress diff --git a/apps/rustbin/kustomization.yaml b/apps/rustbin/kustomization.yaml index e1e32aa..d5e7205 100644 --- a/apps/rustbin/kustomization.yaml +++ b/apps/rustbin/kustomization.yaml @@ -5,3 +5,4 @@ resources: - deployment.yaml - service.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/rustbin/networkpolicy.yaml b/apps/rustbin/networkpolicy.yaml new file mode 100644 index 0000000..7c5ee64 --- /dev/null +++ b/apps/rustbin/networkpolicy.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: rustbin + namespace: rustbin +spec: + egress: [] + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 3000 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: rustbin + policyTypes: + - Ingress + - Egress diff --git a/apps/wireguard/kustomization.yaml b/apps/wireguard/kustomization.yaml index 04acdc5..a16ecb0 100644 --- a/apps/wireguard/kustomization.yaml +++ b/apps/wireguard/kustomization.yaml @@ -7,3 +7,4 @@ resources: - service.yaml - service-admin.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/apps/wireguard/networkpolicy.yaml b/apps/wireguard/networkpolicy.yaml new file mode 100644 index 0000000..6525d72 --- /dev/null +++ b/apps/wireguard/networkpolicy.yaml @@ -0,0 +1,48 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: wireguard + namespace: wireguard +spec: + egress: + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + - to: + - ipBlock: + cidr: 192.168.2.0/24 + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + ingress: + - from: + - ipBlock: + cidr: 0.0.0.0/0 + ports: + - port: 27299 + protocol: UDP + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + ports: + - port: 51821 + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/name: wireguard + policyTypes: + - Ingress + - Egress diff --git a/argocd-apps/apps/jellyfin.yaml b/argocd-apps/apps/jellyfin.yaml index 9d2dbc1..421eba0 100644 --- a/argocd-apps/apps/jellyfin.yaml +++ b/argocd-apps/apps/jellyfin.yaml @@ -30,6 +30,28 @@ spec: enabled: true type: hostPath hostPath: /srv/media + # Metadata, artwork, and subtitles come from the internet; the + # cluster and the LAN stay off limits + networkPolicy: + enabled: true + ingress: + allowExternal: false + namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + egress: + allowAllEgress: false + restrictedEgress: + allowMetadata: false + allowInCluster: false + customRules: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 resources: limits: cpu: 3000m