feat(trmnl): restrict device HTTP ingress to the IoT network

allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and terminus-device is ETP=Local, so the client address reaches the pod. Source is now net-iot; host/remote-node stay for probes. Depends on #1583 (CiliumCIDRGroup net-iot). Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(network-policies): CiliumCIDRGroup per client network
2026-11-06 15:54:41 +01:00 · 2026-11-06 15:45:15 +01:00 · 2026-11-06 13:01:23 +00:00
3 changed files with 161 additions and 4 deletions
@@ -0,0 +1,150 @@
+# Client networks as Cilium CIDR groups, referenced from CNPs via
+# fromCIDRSet.cidrGroupRef. ULA + IPv4 only: the ISP-delegated GUA prefixes
+# change and are not listed.
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-default
+spec:
+  externalCIDRs:
+    - fd00::/64
+    - 192.168.8.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-management
+spec:
+  externalCIDRs:
+    - fd02:10::/64
+    - 10.2.10.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-radius
+spec:
+  externalCIDRs:
+    - fd02:11::/64
+    - 10.2.11.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-video
+spec:
+  externalCIDRs:
+    - 10.2.20.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-iot
+spec:
+  externalCIDRs:
+    - fd02:30::/64
+    - 10.2.30.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-server
+spec:
+  externalCIDRs:
+    - fd02:40::/64
+    - fd40::/64
+    - 10.2.40.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-node
+spec:
+  externalCIDRs:
+    - fd02:46::/64
+    - 10.2.46.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::/64
+    - 10.2.47.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-pod
+spec:
+  externalCIDRs:
+    - fd02:48::/64
+    - 10.2.48.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-privat
+spec:
+  externalCIDRs:
+    - fd02:50::/64
+    - 10.2.50.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-phone
+spec:
+  externalCIDRs:
+    - 10.2.60.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-access
+spec:
+  externalCIDRs:
+    - 10.2.70.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-vpn
+spec:
+  externalCIDRs:
+    - 10.2.80.0/24
+    - 192.168.32.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-guest
+spec:
+  externalCIDRs:
+    - 10.2.90.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-multi-transfer
+spec:
+  externalCIDRs:
+    - 10.2.122.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-multi-lan
+spec:
+  externalCIDRs:
+    - 10.2.123.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-mutti
+spec:
+  externalCIDRs:
+    - 10.2.200.0/24
@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - cidr-groups.yaml
  - default-deny.yaml
  - allow-ingress.yaml
  - ingress-isolation.yaml
@@ -62,9 +62,10 @@ spec:
 # CA, so this bypasses Traefik entirely and the namespace default-deny has
 # to be opened for it — same shape as paperless's allow-ftp-scanner.
 #
-# Scoped to the terminus pods and port 2345 only. Requests still have to
-# carry a known device MAC in the `ID` header plus its api_key; this rule
-# opens the port, not the application.
+# Scoped to the terminus pods, port 2345 and the IoT network (the panel's
+# network; the LB is ETP=Local, so the client address reaches the pod).
+# Requests still have to carry a known device MAC in the `ID` header plus
+# its api_key; this rule opens the port, not the application.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -75,8 +76,13 @@ spec:
    matchLabels:
      app.kubernetes.io/name: terminus
  ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+      toPorts:
+        - ports:
+            - port: "2345"
+              protocol: TCP
    - fromEntities:
-        - world
        - host
        - remote-node
      toPorts:
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	cbc538ec7d	feat(trmnl): restrict device HTTP ingress to the IoT network ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and terminus-device is ETP=Local, so the client address reaches the pod. Source is now net-iot; host/remote-node stay for probes. Depends on #1583 (CiliumCIDRGroup net-iot). Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 15:54:41 +01:00
claude-botandClaude Opus 5.5	6de87eba4c	feat(network-policies): CiliumCIDRGroup per client network ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details One group per UDM client network (ULA + IPv4; ISP-delegated GUA prefixes are not stable and are left out), so LoadBalancer CNPs can restrict sources via fromCIDRSet.cidrGroupRef instead of repeating subnets. Adds no policy; no traffic changes. Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 15:45:15 +01:00
k.renner	1b06a922a9	Merge pull request 'fix(pacman-cache): empty the pacman package cache before the edge image pulls' (#1580 ) from fix/common-pacman-cache into main Reviewed-on: #1580	2026-11-06 13:01:23 +00:00