jakman85
7e8ae472c9
Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01 baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex image tags (bad pins -> :latest; Renovate/update policy pins later).
120 lines
2.6 KiB
YAML
120 lines
2.6 KiB
YAML
---
|
|
# Namespace (trust zone; default-deny + policies apply)
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: 'true'
|
|
---
|
|
# Default-deny baseline (R-NET-01): deny all, allow only DNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: baseline-demo
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# Deployment (R-PLAT-02)
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
homelab.keithjackson.dev/egress-class: internet
|
|
homelab.keithjackson.dev/auth-mode: none
|
|
spec:
|
|
containers:
|
|
- name: baseline-demo
|
|
image: nginx:1.27
|
|
---
|
|
# CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): baseline-demo-allow-internet-egress
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: baseline-demo-allow-internet-egress
|
|
namespace: baseline-demo
|
|
labels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
egress:
|
|
- toEntities:
|
|
- world
|
|
---
|
|
# ServiceMonitor (R-OBS-01)
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
app.kubernetes.io/name: baseline-demo
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: baseline-demo
|
|
namespaceSelector:
|
|
matchNames:
|
|
- baseline-demo
|
|
endpoints:
|
|
- port: metrics
|
|
interval: 30s
|
|
---
|
|
# Flux ImageRepository (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImageRepository
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
spec:
|
|
image: nginx
|
|
interval: 1h0m0s
|
|
---
|
|
# Flux ImagePolicy (R-UPD)
|
|
apiVersion: image.toolkit.fluxcd.io/v1beta2
|
|
kind: ImagePolicy
|
|
metadata:
|
|
name: baseline-demo
|
|
namespace: baseline-demo
|
|
annotations:
|
|
homelab.keithjackson.dev/update-channel: stable
|
|
homelab.keithjackson.dev/auto-rollback: 'true'
|
|
spec:
|
|
imageRepositoryRef:
|
|
name: baseline-demo
|
|
policy:
|
|
semver:
|
|
range: '>=0.0.0'
|