jakman85andClaude Opus 4.8
bb2e9fc931
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
67 lines
2.6 KiB
YAML
67 lines
2.6 KiB
YAML
# Serves: R-NET-01 (default-deny baseline present in every application namespace)
|
|
# Spec: docs/03-networking-isolation-and-egress.md "Default-deny baseline (R-NET-01)".
|
|
#
|
|
# GUARANTEE (not merely a check): whenever an application namespace is created,
|
|
# Kyverno GENERATES the deny-all (ingress+egress) baseline NetworkPolicy, allowing
|
|
# only DNS egress. A workload with no other allow rules can then do nothing but
|
|
# resolve DNS -- the intended starting posture (docs/03).
|
|
#
|
|
# This is the primary R-NET-01 control. The companion policy
|
|
# `validate-default-deny-shape` additionally rejects a MALFORMED hand-written
|
|
# baseline (defense in depth). Per-service `dependencies`/egress allows are layered
|
|
# on top by WS-NET's rendered CiliumNetworkPolicies (T-2.3), never by weakening this.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: require-default-deny-baseline
|
|
annotations:
|
|
policies.kyverno.io/title: Require default-deny NetworkPolicy baseline
|
|
policies.kyverno.io/category: Network Isolation
|
|
policies.kyverno.io/severity: high
|
|
homelab.keithjackson.dev/requirements: R-NET-01
|
|
policies.kyverno.io/description: >-
|
|
Every application namespace must carry a deny-all (ingress+egress) baseline
|
|
NetworkPolicy that permits only DNS egress. Generated automatically on
|
|
namespace creation so the baseline can never be forgotten.
|
|
spec:
|
|
# Also backfill namespaces that already exist when the policy lands.
|
|
generateExisting: true
|
|
rules:
|
|
- name: generate-default-deny
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Namespace
|
|
selector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
generate:
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
name: default-deny
|
|
namespace: "{{ request.object.metadata.name }}"
|
|
synchronize: true
|
|
data:
|
|
metadata:
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
# Deny all ingress.
|
|
ingress: []
|
|
# Deny all egress EXCEPT DNS to the in-cluster resolver (kube-system).
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|