From 342a76d93ededc7c4f838fe8cd34fcf81b441deb Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 22 Apr 2026 16:11:05 +0200 Subject: [PATCH] fix(network-policies): allow any in-cluster source to reach ingress-nginx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ingress-default-deny CNP enumerated `ingress`, `apps`, `paperless` as allowed-from namespaces. Any other namespace's pods (e.g. audiobookshelf) couldn't reach ingress-nginx in-cluster — surfaced while verifying the k8s_gateway DNS fix: ABS resolved auth.renner.uno to 10.2.40.80 correctly, but TCP connect timed out because the policy dropped the packet. Replace the per-namespace allow list with a `cluster` entity match. Any pod in the cluster can now reach ingress-nginx; external entry is still bounded by the existing Cloudflare/MetalLB/host-probe paths. New app namespaces no longer need a policy edit. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../network-policies/ingress-isolation.yaml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml index b9138aa7..30ecbcfc 100644 --- a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml +++ b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml @@ -88,8 +88,12 @@ spec: - toEntities: - world --- -# Default deny ingress to ingress namespace from other namespaces -# Allow from external (Cloudflare/MetalLB) and host (health probes) +# Default deny ingress to ingress namespace from external sources only. +# Any in-cluster pod may reach ingress-nginx (required for east-west +# OIDC flows via k8s_gateway — audiobookshelf → Authentik etc.); we +# don't enumerate namespaces, which would require policy edits every +# time a new app lands. External entry is still bounded by the +# Cloudflare-proxied / MetalLB / host probe paths. apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: @@ -98,16 +102,8 @@ metadata: spec: endpointSelector: {} ingress: - - fromEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": ingress - - fromEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": apps - - fromEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": paperless - fromEntities: + - cluster - host - remote-node - world