diff --git a/actual-budget/networkpolicy.yaml b/actual-budget/networkpolicy.yaml new file mode 100644 index 0000000..e0064fe --- /dev/null +++ b/actual-budget/networkpolicy.yaml @@ -0,0 +1,57 @@ +# Actual faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# The OIDC login goes through authentik's public address. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 5006 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/bolletjestrui/networkpolicy.yaml b/bolletjestrui/networkpolicy.yaml new file mode 100644 index 0000000..c66b200 --- /dev/null +++ b/bolletjestrui/networkpolicy.yaml @@ -0,0 +1,56 @@ +# Bolletjestrui faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 3000 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/freshrss/networkpolicy.yaml b/freshrss/networkpolicy.yaml new file mode 100644 index 0000000..700702b --- /dev/null +++ b/freshrss/networkpolicy.yaml @@ -0,0 +1,58 @@ +# FreshRSS faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# Feeds and the OIDC login (authentik's public address) go out over +# the internet. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 80 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/gatus/kustomization.yaml b/gatus/kustomization.yaml index 3971ead..8c8cbf9 100644 --- a/gatus/kustomization.yaml +++ b/gatus/kustomization.yaml @@ -10,6 +10,7 @@ resources: - gatus-service.yaml - certificate.yaml - httproute.yaml + - networkpolicy.yaml configMapGenerator: - name: gatus-config diff --git a/gatus/networkpolicy.yaml b/gatus/networkpolicy.yaml new file mode 100644 index 0000000..6970182 --- /dev/null +++ b/gatus/networkpolicy.yaml @@ -0,0 +1,66 @@ +# Gatus faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# Its checks go to public addresses; alerts go to ntfy in-cluster. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 8080 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ntfy + podSelector: + matchLabels: + app: ntfy + ports: + - port: 80 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/gitea/networkpolicy.yaml b/gitea/networkpolicy.yaml new file mode 100644 index 0000000..39de7f4 --- /dev/null +++ b/gitea/networkpolicy.yaml @@ -0,0 +1,57 @@ +# Gitea faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# Mirrors and webhooks go out over the internet. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 3000 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/ntfy/kustomization.yaml b/ntfy/kustomization.yaml index 5e5dbd0..4ad6c57 100644 --- a/ntfy/kustomization.yaml +++ b/ntfy/kustomization.yaml @@ -10,3 +10,4 @@ resources: - ntfy-service.yaml - certificate.yaml - httproute.yaml + - networkpolicy.yaml diff --git a/ntfy/networkpolicy.yaml b/ntfy/networkpolicy.yaml new file mode 100644 index 0000000..1eb485c --- /dev/null +++ b/ntfy/networkpolicy.yaml @@ -0,0 +1,67 @@ +# ntfy faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. +# Push notifications go out over the internet. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 80 + # Gatus sends its alerts to ntfy in-cluster. + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: gatus + podSelector: + matchLabels: + app: gatus + ports: + - port: 80 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/serpbear/networkpolicy.yaml b/serpbear/networkpolicy.yaml new file mode 100644 index 0000000..303f07c --- /dev/null +++ b/serpbear/networkpolicy.yaml @@ -0,0 +1,56 @@ +# SerpBear faces the internet through Envoy, so its pods only reach each +# other, DNS and the internet: not the LAN (NAS, router), the Kubernetes +# API or other namespaces. Its scraper APIs are on the internet. +# Ingress comes from Envoy and the node itself (kubelet probes; 10.1.7.64 +# is the node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). +# Same layout as mbgwp/networkpolicy.yaml. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + - from: + - ipBlock: + cidr: 192.168.1.204/32 + - ipBlock: + cidr: 10.1.7.64/32 + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: envoy-gateway-system + podSelector: + matchLabels: + app.kubernetes.io/name: envoy + ports: + - port: 3000 + egress: + - to: + - podSelector: {} + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - ipBlock: + cidr: 0.0.0.0/0 + except: + - 10.0.0.0/8 + - 100.64.0.0/10 + - 169.254.0.0/16 + - 172.16.0.0/12 + - 192.168.0.0/16