357 lines
8.8 KiB
YAML
357 lines
8.8 KiB
YAML
# CiliumClusterwideNetworkPolicies for the host network stack (nodeSelector-based).
|
|
# CCNPs are additive — node-specific policies extend host-base, not replace it.
|
|
# Entity/endpoint selectors are preferred over CIDRs. CIDRs only match reserved:world
|
|
# identity — use them only for genuinely external IPs (SSH, BGP, DNS gateway).
|
|
|
|
---
|
|
# Base policy: every node.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: host-base
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromEntities:
|
|
- host
|
|
- remote-node
|
|
- kube-apiserver
|
|
toPorts:
|
|
- ports:
|
|
- port: "4240"
|
|
protocol: TCP
|
|
- port: "4244"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- host
|
|
- remote-node
|
|
- kube-apiserver
|
|
icmps:
|
|
- fields:
|
|
- type: 8
|
|
family: IPv4
|
|
# Pods with Cilium identities (e.g. hubble-relay) need fromEndpoints;
|
|
# fromCIDR with pod CIDR compiles to reserved:world and doesn't match.
|
|
- fromEndpoints:
|
|
- {}
|
|
toPorts:
|
|
- ports:
|
|
- port: "4244"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- host
|
|
- remote-node
|
|
toPorts:
|
|
- ports:
|
|
- port: "51871"
|
|
protocol: UDP
|
|
- port: "8472"
|
|
protocol: UDP
|
|
- fromCIDR:
|
|
- 10.63.81.107/24
|
|
- 10.162.8.60/24
|
|
toPorts:
|
|
- ports:
|
|
- port: "22"
|
|
protocol: TCP
|
|
- fromCIDR:
|
|
- 10.77.102.91/32
|
|
- 10.212.111.120/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "179"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- kube-apiserver
|
|
- remote-node
|
|
toPorts:
|
|
- ports:
|
|
- port: "10250"
|
|
protocol: TCP
|
|
# metrics-server pod scrapes kubelet on 10250.
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s:k8s-app: metrics-server
|
|
toPorts:
|
|
- ports:
|
|
- port: "10250"
|
|
protocol: TCP
|
|
egress:
|
|
- toEntities:
|
|
- host
|
|
- remote-node
|
|
- kube-apiserver
|
|
toPorts:
|
|
- ports:
|
|
- port: "4240"
|
|
protocol: TCP
|
|
- port: "4244"
|
|
protocol: TCP
|
|
- port: "51871"
|
|
protocol: UDP
|
|
- port: "8472"
|
|
protocol: UDP
|
|
- toEntities:
|
|
- host
|
|
- remote-node
|
|
- kube-apiserver
|
|
icmps:
|
|
- fields:
|
|
- type: 8
|
|
family: IPv4
|
|
- fields:
|
|
- type: 11
|
|
family: IPv4
|
|
- toCIDR:
|
|
- 10.212.111.120/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "53"
|
|
protocol: UDP
|
|
- port: "53"
|
|
protocol: TCP
|
|
- toEntities:
|
|
- world
|
|
toPorts:
|
|
- ports:
|
|
- port: "67"
|
|
protocol: UDP
|
|
- port: "123"
|
|
protocol: UDP
|
|
# HTTPS: host package repositories and registries use CDN-backed endpoints
|
|
# with changing IPs, so keep this entity-based instead of CIDR-based.
|
|
- toEntities:
|
|
- world
|
|
toPorts:
|
|
- ports:
|
|
- port: "443"
|
|
protocol: TCP
|
|
- toCIDR:
|
|
- 10.77.102.91/32
|
|
- 10.212.111.120/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "179"
|
|
protocol: TCP
|
|
- toEntities:
|
|
- kube-apiserver
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
# API hostname resolves to the OPNsense/HAProxy VIP. Cilium classifies
|
|
# that address as reserved:world/cidr, not kube-apiserver.
|
|
- toCIDR:
|
|
- 10.72.123.235/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
# Cilium health checks
|
|
- toEntities:
|
|
- health
|
|
toPorts:
|
|
- ports:
|
|
- port: "4240"
|
|
protocol: TCP
|
|
- port: "4244"
|
|
protocol: TCP
|
|
- toEntities:
|
|
- health
|
|
icmps:
|
|
- fields:
|
|
- type: 8
|
|
family: IPv4
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: host-kubelet
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: victoriametrics
|
|
app.kubernetes.io/name: vmagent
|
|
app.kubernetes.io/instance: main
|
|
toPorts:
|
|
- ports:
|
|
- port: "10250"
|
|
protocol: TCP
|
|
---
|
|
# Control-plane nodes: apiserver ingress + etcd client/peer traffic.
|
|
# All other rules inherited from host-base.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: host-control-plane
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
nodeSelector:
|
|
matchLabels:
|
|
node-role.kubernetes.io/control-plane: "true"
|
|
ingress:
|
|
# All nodes, pods, and external clients (kubectl) need apiserver access.
|
|
- fromEntities:
|
|
- remote-node
|
|
- host
|
|
- kube-apiserver
|
|
- world
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
- fromEndpoints:
|
|
- {}
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- host
|
|
- remote-node
|
|
- kube-apiserver
|
|
toPorts:
|
|
- ports:
|
|
- port: "2379"
|
|
protocol: TCP
|
|
- port: "2380"
|
|
protocol: TCP
|
|
- fromCIDR:
|
|
- 10.115.187.218/24
|
|
toPorts:
|
|
- ports:
|
|
- port: "2379"
|
|
protocol: TCP
|
|
- port: "2380"
|
|
protocol: TCP
|
|
egress:
|
|
- toEntities:
|
|
- host
|
|
- remote-node
|
|
toPorts:
|
|
- ports:
|
|
- port: "2379"
|
|
protocol: TCP
|
|
- port: "2380"
|
|
protocol: TCP
|
|
- toCIDR:
|
|
- 10.115.187.218/24
|
|
toPorts:
|
|
- ports:
|
|
- port: "2379"
|
|
protocol: TCP
|
|
- port: "2380"
|
|
protocol: TCP
|
|
- toCIDR:
|
|
- 10.212.111.120/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "8443"
|
|
protocol: TCP
|
|
---
|
|
# Gateway API: LoadBalancer VIP traffic is processed via the host network path
|
|
# by Cilium's kube-proxy replacement, so host endpoint policy governs it
|
|
# even though the Envoy proxy runs as a regular pod.
|
|
# Allow LAN/WireGuard and public WAN traffic to ports 80 and 443 on all nodes.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: host-gateway
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromCIDR:
|
|
- 10.115.187.218/24
|
|
- 10.63.81.107/24
|
|
- 10.162.8.60/24
|
|
toPorts:
|
|
- ports:
|
|
- port: "80"
|
|
protocol: TCP
|
|
- port: "443"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- world
|
|
toPorts:
|
|
- ports:
|
|
- port: "80"
|
|
protocol: TCP
|
|
- port: "443"
|
|
protocol: TCP
|
|
---
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumClusterwideNetworkPolicy
|
|
metadata:
|
|
name: host-oci-l4-relay
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
nodeSelector: {}
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: victoriametrics
|
|
app.kubernetes.io/name: vmagent
|
|
app.kubernetes.io/instance: main
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
app.kubernetes.io/name: oci-l4-relay-wan-controller
|
|
toPorts:
|
|
- ports:
|
|
- port: "19100"
|
|
protocol: TCP
|
|
- fromEntities:
|
|
- world
|
|
toPorts:
|
|
- ports:
|
|
- port: "25"
|
|
protocol: TCP
|
|
- port: "465"
|
|
protocol: TCP
|
|
- port: "993"
|
|
protocol: TCP
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
k8s:io.kubernetes.pod.namespace: kube-system
|
|
k8s-app: kube-dns
|
|
toPorts:
|
|
- ports:
|
|
- port: "53"
|
|
protocol: UDP
|
|
- port: "53"
|
|
protocol: TCP
|
|
- toServices:
|
|
- k8sService:
|
|
namespace: stalwart
|
|
serviceName: stalwart-relay
|
|
toPorts:
|
|
- ports:
|
|
- port: "25"
|
|
protocol: TCP
|
|
- port: "465"
|
|
protocol: TCP
|
|
- port: "993"
|
|
protocol: TCP
|
|
- toCIDR:
|
|
- 64.110.109.70/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "51820"
|
|
protocol: UDP
|
|
- toCIDR:
|
|
- 10.40.68.115/32
|
|
toPorts:
|
|
- ports:
|
|
- port: "19100"
|
|
protocol: TCP
|