chore(add-ons): Add network policies to operators and monitoring

add-ons/cnpg/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - networkpolicy.yaml

add-ons/cnpg/networkpolicy.yaml

@@ -0,0 +1,41 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 6443
+          protocol: TCP
+    - ports:
+        - port: 8000
+          protocol: TCP
+      to:
+        - namespaceSelector: {}
+          podSelector:
+            matchExpressions:
+              - key: cnpg.io/cluster
+                operator: Exists
+  ingress:
+    - ports:
+        - port: 9443
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: cloudnative-pg
+  policyTypes:
+    - Ingress
+    - Egress

argocd-apps/add-ons/alloy.yaml

@@ -15,6 +15,33 @@ spec:
     chart: alloy
     helm:
       values: |
+        # Discovers pods through the API and pushes their logs to Loki
+        networkPolicy:
+          enabled: true
+          ingress: []
+          egress:
+            - ports:
+                - port: 53
+                  protocol: UDP
+                - port: 53
+                  protocol: TCP
+              to:
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: kube-system
+                  podSelector:
+                    matchLabels:
+                      k8s-app: kube-dns
+            - ports:
+                - port: 6443
+                  protocol: TCP
+            - ports:
+                - port: 3100
+                  protocol: TCP
+              to:
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: loki
         alloy:
           configMap:
             content: |

argocd-apps/add-ons/cert-manager.yaml

@@ -29,7 +29,18 @@ spec:
             requests:
               cpu: 10m
               memory: 64Mi
+          # The chart's egress fits the controller: ACME and Cloudflare on 443,
+          # DNS-01 propagation checks on 53, and the API on 6443
+          networkPolicy:
+            enabled: true
           cainjector:
+            # Only talks to the API
+            networkPolicy:
+              enabled: true
+              egress:
+                - ports:
+                    - port: 6443
+                      protocol: TCP
             resources:
               limits:
                 cpu: 200m
@@ -38,6 +49,13 @@ spec:
                 cpu: 10m
                 memory: 64Mi
           webhook:
+            # Only talks to the API
+            networkPolicy:
+              enabled: true
+              egress:
+                - ports:
+                    - port: 6443
+                      protocol: TCP
             resources:
               limits:
                 cpu: 200m

argocd-apps/add-ons/cnpg.yaml

@@ -11,22 +11,25 @@ spec:
     namespace: cnpg-system
     server: https://kubernetes.default.svc
   project: default
-  source:
+  sources:
-    chart: cloudnative-pg
+    - chart: cloudnative-pg
-    helm:
+      helm:
-      values: |
+        values: |
-        replicaCount: 1
+          replicaCount: 1
-        config:
+          config:
-          clusterWide: true
+            clusterWide: true
-        resources:
+          resources:
-          limits:
+            limits:
-            cpu: 500m
+              cpu: 500m
-            memory: 256Mi
+              memory: 256Mi
-          requests:
+            requests:
-            cpu: 10m
+              cpu: 10m
-            memory: 64Mi
+              memory: 64Mi
-    repoURL: https://cloudnative-pg.github.io/charts
+      repoURL: https://cloudnative-pg.github.io/charts
-    targetRevision: 0.29.1
+      targetRevision: 0.29.1
+    - path: add-ons/cnpg
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/kube-prometheus-stack.yaml

@@ -47,6 +47,9 @@ spec:
           kubeStateMetrics:
             enabled: false
           prometheusOperator:
+            # The chart's policy only limits ingress to the webhook; egress stays open
+            networkPolicy:
+              enabled: true
             admissionWebhooks:
               certManager:
                 enabled: true
@@ -96,6 +99,38 @@ spec:
                 cpu: 20m
                 memory: 32Mi
           prometheus:
+            # Only Grafana queries it; it scrapes the kubelet and node-exporter on the
+            # node, matched by port so no node IP is needed
+            networkPolicy:
+              enabled: true
+              ingress:
+                - from:
+                    - podSelector:
+                        matchLabels:
+                          app.kubernetes.io/name: grafana
+                  ports:
+                    - port: 9090
+                      protocol: TCP
+              egress:
+                - ports:
+                    - port: 53
+                      protocol: UDP
+                    - port: 53
+                      protocol: TCP
+                  to:
+                    - namespaceSelector:
+                        matchLabels:
+                          kubernetes.io/metadata.name: kube-system
+                      podSelector:
+                        matchLabels:
+                          k8s-app: kube-dns
+                - ports:
+                    - port: 6443
+                      protocol: TCP
+                    - port: 9100
+                      protocol: TCP
+                    - port: 10250
+                      protocol: TCP
             serviceMonitor:
               selfMonitor: false
             prometheusSpec:
@@ -124,6 +159,27 @@ spec:
                       requests:
                         storage: 50Gi
           grafana:
+            # The chart takes one list of egress ports for every destination: OIDC
+            # on 443, Loki, Postgres, the API for the sidecars, and Prometheus
+            networkPolicy:
+              enabled: true
+              allowExternal: false
+              explicitNamespacesSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: traefik
+              egress:
+                enabled: true
+                ports:
+                  - port: 443
+                    protocol: TCP
+                  - port: 3100
+                    protocol: TCP
+                  - port: 5432
+                    protocol: TCP
+                  - port: 6443
+                    protocol: TCP
+                  - port: 9090
+                    protocol: TCP
             admin:
               existingSecret: grafana-admin
             additionalDataSources:

argocd-apps/add-ons/loki.yaml

@@ -15,6 +15,15 @@ spec:
     - chart: loki
       helm:
         values: |
+          # Garage on 3900; the rules sidecar watches the API, which only the
+          # discovery port can allow
+          networkPolicy:
+            enabled: true
+            externalStorage:
+              ports:
+                - 3900
+            discovery:
+              port: 6443
           loki:
             auth_enabled: false
             commonConfig:

argocd-apps/add-ons/sealed-secrets.yaml

@@ -16,6 +16,13 @@ spec:
     helm:
       values: |
         keyrenewperiod: "0"
+        # The API is reached by port alone, so the policy doesn't depend on the node's IP
+        networkPolicy:
+          enabled: true
+          egress:
+            enabled: true
+            kubeapiCidr: 0.0.0.0/0
+            kubeapiPort: 6443
         resources:
           limits:
             cpu: 200m