fix(net): allow SSO apps egress to keycloak backend (Cilium 1.20 CVE-2025-30162)

App SSO broke cluster-wide after the Cilium 1.16.5->1.20.1 upgrade: the CVE-2025-30162 fix (in
>=1.16.8/1.17.2) makes the shared Gateway's L7 proxy re-evaluate a pod's egress policy against
Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) when it hairpins to keycloak.home.
'toEntities: world' matches the Gateway VIP at L3/L4 but not the resolved keycloak identity at L7, so
OIDC discovery/token 403'd ('Access denied') for every app with a NetworkPolicy (gitea/nextcloud/
semaphore/headlamp/crafty...); Grafana survived only because monitoring has no NetworkPolicy.

Fix: explicit toEndpoints egress allow to the keycloak backend for SSO apps.
- catalog/render.py: emit it for auth.mode in {oidc,forward-auth}; re-rendered 8 app goldens.
- platform/headlamp + platform/crafty: hand-written policies get the same allow.
Split-horizon design unchanged. Verified live: headlamp-ns -> keycloak discovery 403 -> 200.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/crafty/networkpolicy.yaml

@@ -80,7 +80,10 @@ spec:
 #     Bedrock binaries) when the operator creates/updates a server.
 #   - The oauth2-proxy sidecar must reach Keycloak at keycloak.home.keithjackson.dev, which coredns
 #     split-horizon resolves to the Gateway VIP (an L2-announced LoadBalancer IP Cilium classifies as
-#     `world`) — so `world` egress covers both the jar downloads AND the OIDC path (same as headlamp).
+#     `world`); the sidecar hairpins THROUGH the shared Gateway. `world` covers the jar downloads and
+#     the VIP at L3/L4, but under Cilium >=1.16.8/1.17.2 (CVE-2025-30162 fix, in 1.20) the Gateway's
+#     L7 proxy re-checks this egress against Keycloak's REAL backend identity (enforce_policy_on_l7lb),
+#     so the OIDC path 403s ("Access denied") without the explicit keycloak toEndpoints allow below.
 #   - The sidecar -> Crafty hop is pod-local (127.0.0.1:8443) and is NOT subject to network policy.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
@@ -96,3 +99,7 @@ spec:
   egress:
     - toEntities:
         - world
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: keycloak
+            app: keycloak

platform/headlamp/networkpolicy.yaml

@@ -53,9 +53,12 @@ spec:
 # Egress allow: Headlamp's backend must reach (a) the kube-apiserver — it forwards each user's OIDC
 # id_token there for per-user RBAC — and (b) Keycloak for the OIDC auth-code/token/JWKS exchange.
 # Keycloak is reached at keycloak.home.keithjackson.dev, which coredns split-horizon resolves to the
-# Gateway VIP (an L2-announced LoadBalancer IP that Cilium classifies as `world`), so `world` egress
-# covers the Keycloak path (same as the gitea OIDC bootstrap). DNS is already allowed by the
-# default-deny baseline above.
+# Gateway VIP (an L2-announced LoadBalancer IP that Cilium classifies as `world`); the pod hairpins
+# THROUGH the shared Gateway. `world` matches the VIP at L3/L4, but under Cilium >=1.16.8/1.17.2 (the
+# CVE-2025-30162 fix, present in 1.20) the Gateway's L7 proxy re-evaluates this egress against
+# Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) — so `world` alone 403s the OIDC
+# path ("Access denied"). The explicit toEndpoints allow to the keycloak backend below is required.
+# DNS is already allowed by the default-deny baseline above.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -71,3 +74,7 @@ spec:
     - toEntities:
         - kube-apiserver
         - world
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: keycloak
+            app: keycloak