---
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `headlamp` is a
# PLATFORM namespace so Kyverno does not auto-generate this — we ship it explicitly (defense in
# depth; this pod holds the kube-apiserver egress path, so it is worth locking down). Same shape as
# the Kyverno-generated app baseline. Cilium enforces the UNION of this NetworkPolicy and the
# CiliumNetworkPolicies below (allow if ANY policy allows), so these add the apiserver/Keycloak/
# Gateway paths on top of the deny-all floor.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: headlamp
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
---
# Gateway ingress allow (R-NET-01/02): only the shared Gateway (the Cilium `ingress` entity) may
# reach Headlamp, on its container port 4466 (Service headlamp:80 -> targetPort 4466).
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: headlamp-allow-gateway-ingress
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: headlamp
  ingress:
    - fromEntities:
        - ingress
      toPorts:
        - ports:
            - port: "4466"
              protocol: TCP
---
# Egress allow: Headlamp's backend must reach (a) the kube-apiserver — it forwards each user's OIDC
# id_token there for per-user RBAC — and (b) Keycloak for the OIDC auth-code/token/JWKS exchange.
# Keycloak is reached at keycloak.home.keithjackson.dev, which coredns split-horizon resolves to the
# Gateway VIP (an L2-announced LoadBalancer IP that Cilium classifies as `world`), so `world` egress
# covers the Keycloak path (same as the gitea OIDC bootstrap). DNS is already allowed by the
# default-deny baseline above.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: headlamp-allow-egress
  namespace: headlamp
  labels:
    app.kubernetes.io/name: headlamp
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: headlamp
  egress:
    - toEntities:
        - kube-apiserver
        - world