ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
357
vendor/infrastructure/cilium/host-firewall/host-firewall.yaml
vendored
Normal file
357
vendor/infrastructure/cilium/host-firewall/host-firewall.yaml
vendored
Normal file
|
|
@ -0,0 +1,357 @@
|
|||
# CiliumClusterwideNetworkPolicies for the host network stack (nodeSelector-based).
|
||||
# CCNPs are additive — node-specific policies extend host-base, not replace it.
|
||||
# Entity/endpoint selectors are preferred over CIDRs. CIDRs only match reserved:world
|
||||
# identity — use them only for genuinely external IPs (SSH, BGP, DNS gateway).
|
||||
|
||||
---
|
||||
# Base policy: every node.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-base
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4240"
|
||||
protocol: TCP
|
||||
- port: "4244"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- kube-apiserver
|
||||
icmps:
|
||||
- fields:
|
||||
- type: 8
|
||||
family: IPv4
|
||||
# Pods with Cilium identities (e.g. hubble-relay) need fromEndpoints;
|
||||
# fromCIDR with pod CIDR compiles to reserved:world and doesn't match.
|
||||
- fromEndpoints:
|
||||
- {}
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4244"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- host
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "51871"
|
||||
protocol: UDP
|
||||
- port: "8472"
|
||||
protocol: UDP
|
||||
- fromCIDR:
|
||||
- 10.63.81.107/24
|
||||
- 10.162.8.60/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "22"
|
||||
protocol: TCP
|
||||
- fromCIDR:
|
||||
- 10.77.102.91/32
|
||||
- 10.212.111.120/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "179"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- kube-apiserver
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "10250"
|
||||
protocol: TCP
|
||||
# metrics-server pod scrapes kubelet on 10250.
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s:k8s-app: metrics-server
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "10250"
|
||||
protocol: TCP
|
||||
egress:
|
||||
- toEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4240"
|
||||
protocol: TCP
|
||||
- port: "4244"
|
||||
protocol: TCP
|
||||
- port: "51871"
|
||||
protocol: UDP
|
||||
- port: "8472"
|
||||
protocol: UDP
|
||||
- toEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- kube-apiserver
|
||||
icmps:
|
||||
- fields:
|
||||
- type: 8
|
||||
family: IPv4
|
||||
- fields:
|
||||
- type: 11
|
||||
family: IPv4
|
||||
- toCIDR:
|
||||
- 10.212.111.120/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
- toEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "67"
|
||||
protocol: UDP
|
||||
- port: "123"
|
||||
protocol: UDP
|
||||
# HTTPS: host package repositories and registries use CDN-backed endpoints
|
||||
# with changing IPs, so keep this entity-based instead of CIDR-based.
|
||||
- toEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
- toCIDR:
|
||||
- 10.77.102.91/32
|
||||
- 10.212.111.120/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "179"
|
||||
protocol: TCP
|
||||
- toEntities:
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
|
||||
# that address as reserved:world/cidr, not kube-apiserver.
|
||||
- toCIDR:
|
||||
- 10.72.123.235/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
# Cilium health checks
|
||||
- toEntities:
|
||||
- health
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "4240"
|
||||
protocol: TCP
|
||||
- port: "4244"
|
||||
protocol: TCP
|
||||
- toEntities:
|
||||
- health
|
||||
icmps:
|
||||
- fields:
|
||||
- type: 8
|
||||
family: IPv4
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-kubelet
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: victoriametrics
|
||||
app.kubernetes.io/name: vmagent
|
||||
app.kubernetes.io/instance: main
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "10250"
|
||||
protocol: TCP
|
||||
---
|
||||
# Control-plane nodes: apiserver ingress + etcd client/peer traffic.
|
||||
# All other rules inherited from host-base.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-control-plane
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
nodeSelector:
|
||||
matchLabels:
|
||||
node-role.kubernetes.io/control-plane: "true"
|
||||
ingress:
|
||||
# All nodes, pods, and external clients (kubectl) need apiserver access.
|
||||
- fromEntities:
|
||||
- remote-node
|
||||
- host
|
||||
- kube-apiserver
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
- fromEndpoints:
|
||||
- {}
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "6443"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- host
|
||||
- remote-node
|
||||
- kube-apiserver
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "2379"
|
||||
protocol: TCP
|
||||
- port: "2380"
|
||||
protocol: TCP
|
||||
- fromCIDR:
|
||||
- 10.115.187.218/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "2379"
|
||||
protocol: TCP
|
||||
- port: "2380"
|
||||
protocol: TCP
|
||||
egress:
|
||||
- toEntities:
|
||||
- host
|
||||
- remote-node
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "2379"
|
||||
protocol: TCP
|
||||
- port: "2380"
|
||||
protocol: TCP
|
||||
- toCIDR:
|
||||
- 10.115.187.218/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "2379"
|
||||
protocol: TCP
|
||||
- port: "2380"
|
||||
protocol: TCP
|
||||
- toCIDR:
|
||||
- 10.212.111.120/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8443"
|
||||
protocol: TCP
|
||||
---
|
||||
# Gateway API: LoadBalancer VIP traffic is processed via the host network path
|
||||
# by Cilium's kube-proxy replacement, so host endpoint policy governs it
|
||||
# even though the Envoy proxy runs as a regular pod.
|
||||
# Allow LAN/WireGuard and public WAN traffic to ports 80 and 443 on all nodes.
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-gateway
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromCIDR:
|
||||
- 10.115.187.218/24
|
||||
- 10.63.81.107/24
|
||||
- 10.162.8.60/24
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "80"
|
||||
protocol: TCP
|
||||
- port: "443"
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: host-oci-l4-relay
|
||||
annotations:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingress:
|
||||
- fromEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: victoriametrics
|
||||
app.kubernetes.io/name: vmagent
|
||||
app.kubernetes.io/instance: main
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
app.kubernetes.io/name: oci-l4-relay-wan-controller
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "19100"
|
||||
protocol: TCP
|
||||
- fromEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "25"
|
||||
protocol: TCP
|
||||
- port: "465"
|
||||
protocol: TCP
|
||||
- port: "993"
|
||||
protocol: TCP
|
||||
egress:
|
||||
- toEndpoints:
|
||||
- matchLabels:
|
||||
k8s:io.kubernetes.pod.namespace: kube-system
|
||||
k8s-app: kube-dns
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "53"
|
||||
protocol: UDP
|
||||
- port: "53"
|
||||
protocol: TCP
|
||||
- toServices:
|
||||
- k8sService:
|
||||
namespace: stalwart
|
||||
serviceName: stalwart-relay
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "25"
|
||||
protocol: TCP
|
||||
- port: "465"
|
||||
protocol: TCP
|
||||
- port: "993"
|
||||
protocol: TCP
|
||||
- toCIDR:
|
||||
- 64.110.109.70/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "51820"
|
||||
protocol: UDP
|
||||
- toCIDR:
|
||||
- 10.40.68.115/32
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "19100"
|
||||
protocol: TCP
|
||||
Loading…
Reference in a new issue