envoy-gateway-system: NetworkPolicy

apps/templates/cloudnative-pg-folder.yaml

@@ -1,19 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cloudnative-pg-folder
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: cloudnative-pg
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: cnpg-system
-  syncPolicy:
-    automated:
-      selfHeal: true

apps/templates/default-folder.yaml

@@ -1,19 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: default-folder
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: default
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      selfHeal: true

apps/templates/external-secrets-folder.yaml

@@ -1,19 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: external-secrets-folder
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: external-secrets
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: external-secrets
-  syncPolicy:
-    automated:
-      selfHeal: true

cert-manager/networkpolicy.yaml

@@ -1,73 +0,0 @@
-# cert-manager's three pods reach each other, DNS and the API server (the
-# node, port 16443), and take connections only from each other and the
-# node: the API server calls the webhook from there and the kubelet probes
-# come from there too (10.1.7.64 is the node's Calico VXLAN address,
-# projectcalico.org/IPv4VXLANTunnelAddr). Nothing scrapes the metrics on
-# 9402. The HTTP-01 solver pods run in each Certificate's own namespace
-# (acme-http01-solver in <namespace>/networkpolicy.yaml), not here.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-        - ipBlock:
-            cidr: 10.1.7.64/32
-  egress:
-    - to:
-        - podSelector: {}
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-      ports:
-        - port: 16443
----
-# The controller talks to Let's Encrypt (443), and before it lets Let's
-# Encrypt check a challenge it fetches http://<host>/.well-known/... itself
-# (80). Every certificate's host has a public address, node001's or the
-# home router's (checked 2026-10-26), so the LAN stays out.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: controller-to-internet
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: cert-manager
-      app.kubernetes.io/component: controller
-  policyTypes:
-    - Egress
-  egress:
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 100.64.0.0/10
-              - 169.254.0.0/16
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-      ports:
-        - port: 80
-        - port: 443

cloudnative-pg/networkpolicy.yaml

@@ -1,56 +0,0 @@
-# The CloudNativePG operator reaches DNS, the API server (the node, port
-# 16443) and the PostgreSQL instances it runs in other namespaces: the
-# instance manager's status port (8000) and PostgreSQL (5432), which the
-# instances' own policies let in (postgres-cnpg in authentik and immich).
-# Besides its own namespace it takes connections only from the node: the
-# API server calls its webhook (9443) from there and the kubelet probes
-# come from there too (10.1.7.64 is the node's Calico VXLAN address,
-# projectcalico.org/IPv4VXLANTunnelAddr). The chart's Application
-# (apps/templates/cloudnativepg-helm.yaml) only installs the chart, so
-# this folder gets an Application of its own, cloudnative-pg-folder.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-        - ipBlock:
-            cidr: 10.1.7.64/32
-  egress:
-    - to:
-        - podSelector: {}
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-      ports:
-        - port: 16443
-    - to:
-        - namespaceSelector: {}
-          podSelector:
-            matchExpressions:
-              - key: cnpg.io/cluster
-                operator: Exists
-      ports:
-        - port: 8000
-        - port: 5432

default/networkpolicy.yaml

@@ -1,14 +0,0 @@
-# Nothing runs in default (2026-10-26: only the kubernetes Service, whose
-# endpoint is the API server on the node, which this doesn't touch). A pod
-# started here, by `kubectl run` or a manifest without a namespace, gets
-# no network at all, instead of reaching the LAN, Vault and every app.
-# Anything that needs a network gets a namespace and a policy of its own.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress

dns/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - external-secret.yaml
   - rbac.yaml
   - cronjob.yaml
-  - networkpolicy.yaml
 
 configMapGenerator:
   - name: dns-sync-script

dns/networkpolicy.yaml

@@ -1,37 +0,0 @@
-# The only pod here is the dns-sync Job (a PostSync hook): it installs its
-# Python packages from PyPI and pushes domains/ to TransIP's API, so it
-# reaches DNS and the internet (not the LAN, the API server or other
-# namespaces). Nothing connects to it.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  egress:
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 100.64.0.0/10
-              - 169.254.0.0/16
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-      ports:
-        - port: 443

external-secrets/networkpolicy.yaml

@@ -1,68 +0,0 @@
-# External Secrets' three pods reach each other, DNS and the API server
-# (the node, port 16443); the controller also reads Vault
-# (vault-active.vault.svc:8200, which vault/networkpolicy.yaml lets it
-# into). Besides their own namespace they take connections only from the
-# node: the API server calls the webhook from there and the kubelet probes
-# come from there too (10.1.7.64 is the node's Calico VXLAN address,
-# projectcalico.org/IPv4VXLANTunnelAddr). The Password generator behind
-# gatus/backup-check-token needs no network. The chart's Application
-# (apps/templates/external-secrets-helm.yaml) only installs the chart, so
-# this folder gets an Application of its own, external-secrets-folder.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-        - ipBlock:
-            cidr: 10.1.7.64/32
-  egress:
-    - to:
-        - podSelector: {}
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-      ports:
-        - port: 16443
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: controller-to-vault
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: external-secrets
-  policyTypes:
-    - Egress
-  egress:
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: vault
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: vault
-      ports:
-        - port: 8200

gateway/networkpolicy.yaml

@@ -0,0 +1,120 @@
+# Envoy Gateway: the controller and the proxy it runs (envoyproxy.yaml).
+# Both reach each other (the proxy gets its config from the controller on
+# 18000) and DNS, and take connections from each other and the node: the
+# API server calls the controller's topology webhook (9443) from there and
+# the kubelet probes come from there too (10.1.7.64 is the node's Calico
+# VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). Nothing scrapes
+# the metrics on 19001.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+  namespace: envoy-gateway-system
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+# The proxy holds the node's ports 80 and 443 (10080 and 10443 inside) and
+# takes connections there from anywhere: the internet through node001 and
+# the router, the LAN, and pods that call a public hostname. It reaches
+# every app it routes to (pods in any namespace; their own policies decide
+# which port), Home Assistant on 192.168.1.202:8123 (outside the cluster,
+# home-assistant/), and the internet on 443 for Longhorn's OIDC login
+# (authentik's token endpoint, at its public address).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: proxy
+  namespace: envoy-gateway-system
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: envoy
+      app.kubernetes.io/component: proxy
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - ports:
+        - port: 10080
+        - port: 10443
+  egress:
+    - to:
+        - namespaceSelector: {}
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.202/32
+      ports:
+        - port: 8123
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 443
+---
+# Everything but the proxy (the controller, and the chart's certgen job on
+# upgrades) reaches the API server (the node, port 16443). The controller
+# also fetches the OIDC discovery document of Longhorn's SecurityPolicy
+# from authentik's public address.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: control-plane
+  namespace: envoy-gateway-system
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: NotIn
+        values:
+          - envoy
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 443

mariadb-operator/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
   - operator-crds-helm.yaml
   - operator-helm.yaml
-  - networkpolicy.yaml

mariadb-operator/networkpolicy.yaml

@@ -1,54 +0,0 @@
-# The mariadb-operator's three pods reach each other, DNS and the API
-# server (the node, port 16443); the operator also connects to MariaDB on
-# 3306 for the databases, users and grants it manages (mbgwp's
-# mariadb-from-operator lets it in). Besides their own namespace they take
-# connections only from the node: the API server calls the webhook from
-# there and the kubelet probes come from there too (10.1.7.64 is the node's
-# Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). This
-# folder's Application deploys into argocd (the operator's own
-# Applications), hence the namespace here.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-  namespace: mariadb-system
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-        - ipBlock:
-            cidr: 10.1.7.64/32
-  egress:
-    - to:
-        - podSelector: {}
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-      ports:
-        - port: 16443
-    - to:
-        - namespaceSelector: {}
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: mariadb
-      ports:
-        - port: 3306

velero/networkpolicy.yaml

@@ -1,52 +0,0 @@
-# Velero, its node agent, and the pods it starts here (the data movers of
-# each pod volume backup or restore, kopia's maintenance jobs, the chart's
-# CRD upgrade job) reach each other, DNS, the API server (the node, port
-# 16443) and Garage on the NAS (192.168.1.99:3900, nas/garage). The node
-# agent reads volumes through its hostPath mount, not the network. Besides
-# their own namespace they take connections only from the node (kubelet
-# probes; 10.1.7.64 is the node's Calico VXLAN address,
-# projectcalico.org/IPv4VXLANTunnelAddr); nothing scrapes the metrics on
-# 8085. MinIO (the NAS, port 9000) is not allowed: going back to it means
-# adding its port here as well.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-        - ipBlock:
-            cidr: 10.1.7.64/32
-  egress:
-    - to:
-        - podSelector: {}
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.204/32
-      ports:
-        - port: 16443
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.99/32
-      ports:
-        - port: 3900