jakman85andClaude Opus 4.8
68690e5019
App SSO broke cluster-wide after the Cilium 1.16.5->1.20.1 upgrade: the CVE-2025-30162 fix (in
>=1.16.8/1.17.2) makes the shared Gateway's L7 proxy re-evaluate a pod's egress policy against
Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) when it hairpins to keycloak.home.
'toEntities: world' matches the Gateway VIP at L3/L4 but not the resolved keycloak identity at L7, so
OIDC discovery/token 403'd ('Access denied') for every app with a NetworkPolicy (gitea/nextcloud/
semaphore/headlamp/crafty...); Grafana survived only because monitoring has no NetworkPolicy.
Fix: explicit toEndpoints egress allow to the keycloak backend for SSO apps.
- catalog/render.py: emit it for auth.mode in {oidc,forward-auth}; re-rendered 8 app goldens.
- platform/headlamp + platform/crafty: hand-written policies get the same allow.
Split-horizon design unchanged. Verified live: headlamp-ns -> keycloak discovery 403 -> 200.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
81 lines
2.8 KiB
YAML
81 lines
2.8 KiB
YAML
---
|
|
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `headlamp` is a
|
|
# PLATFORM namespace so Kyverno does not auto-generate this — we ship it explicitly (defense in
|
|
# depth; this pod holds the kube-apiserver egress path, so it is worth locking down). Same shape as
|
|
# the Kyverno-generated app baseline. Cilium enforces the UNION of this NetworkPolicy and the
|
|
# CiliumNetworkPolicies below (allow if ANY policy allows), so these add the apiserver/Keycloak/
|
|
# Gateway paths on top of the deny-all floor.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny
|
|
namespace: headlamp
|
|
labels:
|
|
homelab.keithjackson.dev/baseline: default-deny
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
---
|
|
# Gateway ingress allow (R-NET-01/02): only the shared Gateway (the Cilium `ingress` entity) may
|
|
# reach Headlamp, on its container port 4466 (Service headlamp:80 -> targetPort 4466).
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: headlamp-allow-gateway-ingress
|
|
namespace: headlamp
|
|
labels:
|
|
app.kubernetes.io/name: headlamp
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: headlamp
|
|
ingress:
|
|
- fromEntities:
|
|
- ingress
|
|
toPorts:
|
|
- ports:
|
|
- port: "4466"
|
|
protocol: TCP
|
|
---
|
|
# Egress allow: Headlamp's backend must reach (a) the kube-apiserver — it forwards each user's OIDC
|
|
# id_token there for per-user RBAC — and (b) Keycloak for the OIDC auth-code/token/JWKS exchange.
|
|
# Keycloak is reached at keycloak.home.keithjackson.dev, which coredns split-horizon resolves to the
|
|
# Gateway VIP (an L2-announced LoadBalancer IP that Cilium classifies as `world`); the pod hairpins
|
|
# THROUGH the shared Gateway. `world` matches the VIP at L3/L4, but under Cilium >=1.16.8/1.17.2 (the
|
|
# CVE-2025-30162 fix, present in 1.20) the Gateway's L7 proxy re-evaluates this egress against
|
|
# Keycloak's REAL backend cluster identity (enforce_policy_on_l7lb) — so `world` alone 403s the OIDC
|
|
# path ("Access denied"). The explicit toEndpoints allow to the keycloak backend below is required.
|
|
# DNS is already allowed by the default-deny baseline above.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: headlamp-allow-egress
|
|
namespace: headlamp
|
|
labels:
|
|
app.kubernetes.io/name: headlamp
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: headlamp
|
|
egress:
|
|
- toEntities:
|
|
- kube-apiserver
|
|
- world
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
io.kubernetes.pod.namespace: keycloak
|
|
app: keycloak
|