# CiliumClusterwideNetworkPolicies for the host network stack (nodeSelector-based).
# CCNPs are additive — node-specific policies extend host-base, not replace it.
# Entity/endpoint selectors are preferred over CIDRs. CIDRs only match reserved:world
# identity — use them only for genuinely external IPs (SSH, BGP, DNS gateway).

---
# Base policy: every node.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-base
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  nodeSelector: {}
  ingress:
    - fromEntities:
        - host
        - remote-node
        - kube-apiserver
      toPorts:
        - ports:
            - port: "4240"
              protocol: TCP
            - port: "4244"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
        - kube-apiserver
      icmps:
        - fields:
            - type: 8
              family: IPv4
    # Pods with Cilium identities (e.g. hubble-relay) need fromEndpoints;
    # fromCIDR with pod CIDR compiles to reserved:world and doesn't match.
    - fromEndpoints:
        - {}
      toPorts:
        - ports:
            - port: "4244"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "51871"
              protocol: UDP
            - port: "8472"
              protocol: UDP
    - fromCIDR:
        - 10.63.81.107/24
        - 10.162.8.60/24
      toPorts:
        - ports:
            - port: "22"
              protocol: TCP
    - fromCIDR:
        - 10.77.102.91/32
        - 10.212.111.120/32
      toPorts:
        - ports:
            - port: "179"
              protocol: TCP
    - fromEntities:
        - kube-apiserver
        - remote-node
      toPorts:
        - ports:
            - port: "10250"
              protocol: TCP
    # metrics-server pod scrapes kubelet on 10250.
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s:k8s-app: metrics-server
      toPorts:
        - ports:
            - port: "10250"
              protocol: TCP
  egress:
    - toEntities:
        - host
        - remote-node
        - kube-apiserver
      toPorts:
        - ports:
            - port: "4240"
              protocol: TCP
            - port: "4244"
              protocol: TCP
            - port: "51871"
              protocol: UDP
            - port: "8472"
              protocol: UDP
    - toEntities:
        - host
        - remote-node
        - kube-apiserver
      icmps:
        - fields:
            - type: 8
              family: IPv4
        - fields:
            - type: 11
              family: IPv4
    - toCIDR:
        - 10.212.111.120/32
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
    - toEntities:
        - world
      toPorts:
        - ports:
            - port: "67"
              protocol: UDP
            - port: "123"
              protocol: UDP
    # HTTPS: host package repositories and registries use CDN-backed endpoints
    # with changing IPs, so keep this entity-based instead of CIDR-based.
    - toEntities:
        - world
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP
    - toCIDR:
        - 10.77.102.91/32
        - 10.212.111.120/32
      toPorts:
        - ports:
            - port: "179"
              protocol: TCP
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    # API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
    # that address as reserved:world/cidr, not kube-apiserver.
    - toCIDR:
        - 10.72.123.235/32
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    # Cilium health checks
    - toEntities:
        - health
      toPorts:
        - ports:
            - port: "4240"
              protocol: TCP
            - port: "4244"
              protocol: TCP
    - toEntities:
        - health
      icmps:
        - fields:
            - type: 8
              family: IPv4
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-kubelet
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  nodeSelector: {}
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: victoriametrics
            app.kubernetes.io/name: vmagent
            app.kubernetes.io/instance: main
      toPorts:
        - ports:
            - port: "10250"
              protocol: TCP
---
# Control-plane nodes: apiserver ingress + etcd client/peer traffic.
# All other rules inherited from host-base.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-control-plane
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  nodeSelector:
    matchLabels:
      node-role.kubernetes.io/control-plane: "true"
  ingress:
    # All nodes, pods, and external clients (kubectl) need apiserver access.
    - fromEntities:
        - remote-node
        - host
        - kube-apiserver
        - world
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - fromEndpoints:
        - {}
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
        - kube-apiserver
      toPorts:
        - ports:
            - port: "2379"
              protocol: TCP
            - port: "2380"
              protocol: TCP
    - fromCIDR:
        - 10.115.187.218/24
      toPorts:
        - ports:
            - port: "2379"
              protocol: TCP
            - port: "2380"
              protocol: TCP
  egress:
    - toEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "2379"
              protocol: TCP
            - port: "2380"
              protocol: TCP
    - toCIDR:
        - 10.115.187.218/24
      toPorts:
        - ports:
            - port: "2379"
              protocol: TCP
            - port: "2380"
              protocol: TCP
    - toCIDR:
        - 10.212.111.120/32
      toPorts:
        - ports:
            - port: "8443"
              protocol: TCP
---
# Gateway API: LoadBalancer VIP traffic is processed via the host network path
# by Cilium's kube-proxy replacement, so host endpoint policy governs it
# even though the Envoy proxy runs as a regular pod.
# Allow LAN/WireGuard and public WAN traffic to ports 80 and 443 on all nodes.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-gateway
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  nodeSelector: {}
  ingress:
    - fromCIDR:
        - 10.115.187.218/24
        - 10.63.81.107/24
        - 10.162.8.60/24
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
    - fromEntities:
        - world
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-oci-l4-relay
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
spec:
  nodeSelector: {}
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: victoriametrics
            app.kubernetes.io/name: vmagent
            app.kubernetes.io/instance: main
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            app.kubernetes.io/name: oci-l4-relay-wan-controller
      toPorts:
        - ports:
            - port: "19100"
              protocol: TCP
    - fromEntities:
        - world
      toPorts:
        - ports:
            - port: "25"
              protocol: TCP
            - port: "465"
              protocol: TCP
            - port: "993"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
    - toServices:
        - k8sService:
            namespace: stalwart
            serviceName: stalwart-relay
      toPorts:
        - ports:
            - port: "25"
              protocol: TCP
            - port: "465"
              protocol: TCP
            - port: "993"
              protocol: TCP
    - toCIDR:
        - 64.110.109.70/32
      toPorts:
        - ports:
            - port: "51820"
              protocol: UDP
    - toCIDR:
        - 10.40.68.115/32
      toPorts:
        - ports:
            - port: "19100"
              protocol: TCP