---
# Cilium Gateway: reserved:ingress is the identity Cilium assigns to L7 LB listeners
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: gateway-internal
spec:
  endpointSelector:
    matchLabels:
      "reserved:ingress": ""
  ingress:
    - fromCIDR:
        - 10.115.187.218/24
        - 10.63.81.107/24
        - 10.162.8.60/24
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# Relay gateway: allow public traffic to the shared reserved:ingress identity.
# Cilium uses the same ingress identity for Gateway API listeners, so this
# must be additive with the internal gateway policy above. Local testing and
# internal clients can also reach the relay listener from trusted subnets or host.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: gateway-relay
spec:
  endpointSelector:
    matchLabels:
      "reserved:ingress": ""
  ingress:
    - fromCIDR:
        - 10.115.187.218/24
        - 10.63.81.107/24
        - 10.162.8.60/24
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
    - fromEntities:
        - host
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
    - fromEntities:
        - ingress
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
    - fromEntities:
        - world
      toPorts:
        - ports:
            - port: "80"
              protocol: TCP
            - port: "443"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# CoreDNS: accept DNS queries from all pods cluster-wide,
# and reach out to the apiserver for zone sync.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: coredns
  namespace: kube-system
spec:
  endpointSelector:
    matchLabels:
      k8s-app: kube-dns
  ingress:
    - fromEntities:
        - cluster
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
    - fromEntities:
        - host
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
            - port: "8181"
              protocol: TCP
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: network-dns
            app.kubernetes.io/name: coredns
            app.kubernetes.io/instance: network-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
    - toEntities:
        - world
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# metrics-server: scraped by kubelet via host on 10250.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: metrics-server
  namespace: kube-system
spec:
  endpointSelector:
    matchLabels:
      k8s-app: metrics-server
  ingress:
    - fromEntities:
        - host
        - remote-node
        - kube-apiserver
      toPorts:
        - ports:
            - port: "10250"
              protocol: TCP
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEntities:
        - host
        - remote-node
        - kube-apiserver
      toPorts:
        - ports:
            - port: "10250"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
---
# local-path-provisioner: only needs the apiserver.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: local-path-provisioner
  namespace: kube-system
spec:
  endpointSelector:
    matchLabels:
      app: local-path-provisioner
  ingress: []
  egress:
    - toEntities:
        - kube-apiserver
        - host
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
---
# Hubble relay: reached by the Hubble CLI/observer on 4222 from the host.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: hubble-relay
  namespace: kube-system
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: hubble-relay
  ingress:
    - fromEntities:
        - host
      toPorts:
        - ports:
            - port: "4222"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s:app.kubernetes.io/name: hubble-ui
      toPorts:
        - ports:
            - port: "4245"
              protocol: TCP
  egress:
    - toEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "4244"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
---
# Hubble UI backend: talks to hubble-relay.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: hubble-ui
  namespace: kube-system
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: hubble-ui
  ingress:
    - fromEntities:
        - host
      toPorts:
        - ports:
            - port: "8081"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            app.kubernetes.io/name: hubble-relay
      toPorts:
        - ports:
            - port: "4245"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
---
# Host egress to kube-system pods (DNS, metrics, hubble relay).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-egress-kube-system
spec:
  nodeSelector: {}
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
            - port: "10250"
              protocol: TCP
            - port: "8181"
              protocol: TCP
            - port: "8081"
              protocol: TCP
            - port: "4222"
              protocol: TCP
            - port: "8080"
              protocol: TCP