From 3e7ba2564c8c508676eeaffcc1b5dfd2b3fd0aa6 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 20 May 2026 16:07:26 +0200 Subject: [PATCH] network-policies(authentik): allow all ICMP types in/out Same pattern as home-assistant (d61b24d). --- .../network-policies/authentik-ns.yaml | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/kubernetes/infrastructure/network-policies/authentik-ns.yaml b/kubernetes/infrastructure/network-policies/authentik-ns.yaml index e8061cc8..33fc0946 100644 --- a/kubernetes/infrastructure/network-policies/authentik-ns.yaml +++ b/kubernetes/infrastructure/network-policies/authentik-ns.yaml @@ -28,6 +28,53 @@ spec: - fromEntities: - host - remote-node + # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See + # home-assistant-ns.yaml for the rationale. + - fromEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 } egress: - toEndpoints: - matchLabels: @@ -47,3 +94,49 @@ spec: - host - remote-node - world + # ICMP — egress mirror. + - toEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 }