---
# longhorn-manager: intra-ns communication, apiserver, metrics from host.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-manager
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-manager
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
            - port: "9502"
              protocol: TCP
            - port: "9503"
              protocol: TCP
            - port: "8501"
              protocol: TCP
            - port: "8503"
              protocol: TCP
            - port: "8500"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "9502"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
            - port: "9502"
              protocol: TCP
            - port: "8501"
              protocol: TCP
            - port: "8503"
              protocol: TCP
            - port: "8500"
              protocol: TCP
            - port: "9600"
              protocol: TCP
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toFQDNs:
        - matchName: longhorn-upgrade-responder.rancher.io
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-manager-ingress-vmagent
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-manager
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: victoriametrics
            app.kubernetes.io/name: vmagent
            app.kubernetes.io/instance: main
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
---
# longhorn-driver-deployer: installs CSI driver, needs manager API, apiserver + DNS.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-driver-deployer
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-driver-deployer
  ingress: []
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
            app: longhorn-manager
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
    - toEntities:
        - kube-apiserver
        - remote-node
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# CSI sidecar pods (attacher, provisioner, resizer): only need apiserver + DNS.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-csi-sidecars
  namespace: longhorn
spec:
  endpointSelector:
    matchExpressions:
      - key: app
        operator: In
        values:
          - csi-attacher
          - csi-provisioner
          - csi-resizer
          - csi-snapshotter
  ingress: []
  egress:
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# longhorn-csi-plugin: metrics from host, talks to longhorn-manager.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-csi-plugin
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-csi-plugin
  ingress:
    - fromEntities:
        - host
      toPorts:
        - ports:
            - port: "9808"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
            app: longhorn-manager
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
    - toEntities:
        - kube-apiserver
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# Host egress to longhorn pods (iSCSI, CSI plugin metrics, manager metrics).
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-egress-longhorn
spec:
  nodeSelector: {}
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
      toPorts:
        - ports:
            - port: "3260"
              protocol: TCP
            - port: "9808"
              protocol: TCP
            - port: "9502"
              protocol: TCP
            - port: "2049"
              protocol: TCP
            - port: "9505"
              protocol: TCP

---
# share-manager: longhorn-manager gRPC health/control and host NFS clients.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-share-manager
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      longhorn.io/component: share-manager
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
            app: longhorn-manager
      toPorts:
        - ports:
            - port: "9600"
              protocol: TCP
    - fromEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "2049"
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
            app: longhorn-manager
      toPorts:
        - ports:
            - port: "9503"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# longhorn-ui: frontend that talks to longhorn-manager API.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-ui
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-ui
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
            app: longhorn-manager
      toPorts:
        - ports:
            - port: "9500"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
# instance-managers: iSCSI from host, intra-ns engine/replica RPC (10000-20000),
# longhorn-manager control plane (8501, 8503), DNS.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-instance-manager
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      longhorn.io/component: instance-manager
  ingress:
    - fromEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "3260"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
      toPorts:
        - ports:
            - port: "8500"
              protocol: TCP
            - port: "8501"
              protocol: TCP
            - port: "8503"
              protocol: TCP
            - port: "10000"
              endPort: 20000
              protocol: TCP
  egress:
    - toEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "3260"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: longhorn
      toPorts:
        - ports:
            - port: "10000"
              endPort: 20000
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: longhorn-global
  namespace: longhorn
spec:
  endpointSelector:
    matchLabels:
      app: longhorn-global-manager
  ingress:
    - fromEntities: [host, remote-node]
      toPorts:
        - ports:
            - port: "9505"
              protocol: TCP
  egress:
    - toEntities: [kube-apiserver]
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP