feat(kube-system): add cilium network segmentation policies

kubernetes/apps/kube-system/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - ./descheduler/ks.yaml
   - ./generic-device-plugin/ks.yaml
   - ./metrics-server/ks.yaml
+  - ./network-policies/ks.yaml
   - ./reloader/ks.yaml
   - ./snapshot-controller/ks.yaml
   - ./spegel/ks.yaml

kubernetes/apps/kube-system/network-policies/app/database-ingress.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/cilium.io/ciliumnetworkpolicy_v2.json
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: database-ingress-allowlist
+  namespace: database
+spec:
+  # endpointSelector {} => default-deny ingress for every pod in the namespace
+  # (postgres, poolers, dragonfly, cnpg + dragonfly operators). Egress stays
+  # default-allow (backups to NFS/S3, operator->apiserver keep working).
+  endpointSelector: {}
+  ingress:
+    # Namespaces that actually consume postgres/pgbouncer/dragonfly, discovered
+    # from cnpg databases/ CRs + dragonfly host refs. observability = vmagent
+    # scraping the exporters; database = intra-ns (operator, poolers, replicas).
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: ai
+        - matchLabels:
+            io.kubernetes.pod.namespace: default
+        - matchLabels:
+            io.kubernetes.pod.namespace: media
+        - matchLabels:
+            io.kubernetes.pod.namespace: observability
+        - matchLabels:
+            io.kubernetes.pod.namespace: security
+        - matchLabels:
+            io.kubernetes.pod.namespace: database
+    # cnpg serves validating/mutating webhooks the apiserver must reach.
+    - fromEntities:
+        - kube-apiserver

kubernetes/apps/kube-system/network-policies/app/deny-apiserver-egress.yaml

@@ -0,0 +1,58 @@
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/cilium.io/ciliumnetworkpolicy_v2.json
+# Internet-exposed app namespaces must not reach the kube-apiserver. enableDefaultDeny
+# egress:false keeps this a pure deny overlay — DNS/internet/cluster egress stay
+# default-allow. kopiur movers (managed-by=kopiur) legitimately need the apiserver, so
+# they are excluded via NotIn (also matches label-absent app pods => they ARE denied).
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: deny-kube-apiserver-egress
+  namespace: media
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/managed-by
+        operator: NotIn
+        values: [kopiur]
+  enableDefaultDeny:
+    egress: false
+  egressDeny:
+    - toEntities:
+        - kube-apiserver
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/cilium.io/ciliumnetworkpolicy_v2.json
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: deny-kube-apiserver-egress
+  namespace: default
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/managed-by
+        operator: NotIn
+        values: [kopiur]
+  enableDefaultDeny:
+    egress: false
+  egressDeny:
+    - toEntities:
+        - kube-apiserver
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/cilium.io/ciliumnetworkpolicy_v2.json
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: deny-kube-apiserver-egress
+  namespace: web3
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/managed-by
+        operator: NotIn
+        values: [kopiur]
+  enableDefaultDeny:
+    egress: false
+  egressDeny:
+    - toEntities:
+        - kube-apiserver

kubernetes/apps/kube-system/network-policies/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# No namespace transformer: each policy declares its own metadata.namespace.
+resources:
+  - database-ingress.yaml
+  - deny-apiserver-egress.yaml

kubernetes/apps/kube-system/network-policies/ks.yaml

@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: network-policies
+  namespace: &namespace kube-system
+spec:
+  interval: 1h
+  # No targetNamespace: policies fan out to database/media/default/web3 by their
+  # own metadata.namespace.
+  path: ./kubernetes/apps/kube-system/network-policies/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: false