# Serves: R-NET-01 (default-deny baseline present in every application namespace)
# Spec: docs/03-networking-isolation-and-egress.md "Default-deny baseline (R-NET-01)".
#
# GUARANTEE (not merely a check): whenever an application namespace is created,
# Kyverno GENERATES the deny-all (ingress+egress) baseline NetworkPolicy, allowing
# only DNS egress. A workload with no other allow rules can then do nothing but
# resolve DNS -- the intended starting posture (docs/03).
#
# This is the primary R-NET-01 control. The companion policy
# `validate-default-deny-shape` additionally rejects a MALFORMED hand-written
# baseline (defense in depth). Per-service `dependencies`/egress allows are layered
# on top by WS-NET's rendered CiliumNetworkPolicies (T-2.3), never by weakening this.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-default-deny-baseline
  annotations:
    policies.kyverno.io/title: Require default-deny NetworkPolicy baseline
    policies.kyverno.io/category: Network Isolation
    policies.kyverno.io/severity: high
    homelab.keithjackson.dev/requirements: R-NET-01
    policies.kyverno.io/description: >-
      Every application namespace must carry a deny-all (ingress+egress) baseline
      NetworkPolicy that permits only DNS egress. Generated automatically on
      namespace creation so the baseline can never be forgotten.
spec:
  # Also backfill namespaces that already exist when the policy lands.
  generateExisting: true
  rules:
    - name: generate-default-deny
      match:
        any:
          - resources:
              kinds:
                - Namespace
              selector:
                matchLabels:
                  homelab.keithjackson.dev/app-namespace: "true"
      generate:
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        name: default-deny
        namespace: "{{ request.object.metadata.name }}"
        synchronize: true
        data:
          metadata:
            labels:
              homelab.keithjackson.dev/baseline: default-deny
          spec:
            podSelector: {}
            policyTypes:
              - Ingress
              - Egress
            # Deny all ingress.
            ingress: []
            # Deny all egress EXCEPT DNS to the in-cluster resolver (kube-system).
            egress:
              - to:
                  - namespaceSelector:
                      matchLabels:
                        kubernetes.io/metadata.name: kube-system
                ports:
                  - protocol: UDP
                    port: 53
                  - protocol: TCP
                    port: 53