jakman85andClaude Opus 4.8
aafb4ca378
The in-cluster Gluetun gateway is retired; VPN egress is now a node-level host OpenVPN split-tunnel (Ansible role vpn_egress_gateway) steered by a Cilium Egress Gateway policy with a host nftables kill-switch (ADR-0015). Credentials moved host-side to the Ansible vault. Update docs/comments only: - platform/vpn-egress/README.md: rewrite for ADR-0015 (live + conformance-green); drop the resolved "option 1 not viable with Gluetun" finding to a brief history note. - platform/kustomization.yaml: Phase 3 comment -> node tunnel + Cilium steering. - platform/kyverno/.../require-egress-class-label.yaml: ADR-0013 -> ADR-0015 steering. - schemas/servicedefinition.schema.json: egress=vpn description -> node tunnel + Cilium. - clusters/base/cluster-vars.yaml: reframe PIA_REGION / CLUSTER_POD_CIDR WHY comments to ADR-0015 (Cilium excludedCIDRs); both keys retained (still referenced/documented). - platform/vpn-egress/namespace.yaml: no privileged gateway pod under ADR-0015. - pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml: comment headers only note they are now UNUSED (creds host-side), retained pending cleanup; payloads untouched. No runtime manifest behavior, alert exprs, kustomization resources, or SOPS payloads changed. No spec-repo edits. Co-Authored-By: Claude Opus 4.8 <[email protected]>
50 lines
2.0 KiB
YAML
50 lines
2.0 KiB
YAML
# Serves: R-NET-05 (egress is a declared property; every workload declares its class)
|
|
# Spec: docs/03 "Egress is a declared property"; docs/13 `egress: internet | vpn`.
|
|
#
|
|
# The egress class is enforced OUTSIDE the service (Cilium Egress Gateway selects
|
|
# pods by label -> steers `vpn` pods out the egress-gateway node's host tun0 VPN
|
|
# tunnel, ADR-0015).
|
|
# For that steering to be possible the label MUST exist on the pod and be one of the
|
|
# two valid classes. A missing/typo'd class would silently fall back to the plain
|
|
# internet path -- a fail-OPEN egress leak -- so we require it explicitly (fail-closed
|
|
# posture, coordination-protocol.md #8).
|
|
#
|
|
# Matches Pods; pod-controller autogen extends to Deployment/StatefulSet/etc.
|
|
# LABEL KEY is a PROPOSED contract owned jointly with WS-NET/WS-GITOPS -- see
|
|
# platform/kyverno/labels.md and the report's escalation note. The VALUES
|
|
# (internet|vpn) are fixed by docs/03 + docs/13.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: require-egress-class-label
|
|
annotations:
|
|
policies.kyverno.io/title: Require egress-class label on workloads
|
|
policies.kyverno.io/category: Network Isolation
|
|
policies.kyverno.io/severity: high
|
|
homelab.keithjackson.dev/requirements: R-NET-05
|
|
policies.kyverno.io/description: >-
|
|
Pods in application namespaces must declare
|
|
homelab.keithjackson.dev/egress-class = internet | vpn.
|
|
spec:
|
|
validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
|
|
background: true
|
|
rules:
|
|
- name: require-egress-class
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaceSelector:
|
|
matchLabels:
|
|
homelab.keithjackson.dev/app-namespace: "true"
|
|
validate:
|
|
message: >-
|
|
Pods in application namespaces must carry the label
|
|
homelab.keithjackson.dev/egress-class set to 'internet' or 'vpn' (R-NET-05,
|
|
docs/03).
|
|
pattern:
|
|
metadata:
|
|
labels:
|
|
homelab.keithjackson.dev/egress-class: "internet | vpn"
|