From 6de87eba4c4b8ba198579437c044e331dc4f59ac Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 6 Nov 2026 15:45:15 +0100 Subject: [PATCH] feat(network-policies): CiliumCIDRGroup per client network One group per UDM client network (ULA + IPv4; ISP-delegated GUA prefixes are not stable and are left out), so LoadBalancer CNPs can restrict sources via fromCIDRSet.cidrGroupRef instead of repeating subnets. Adds no policy; no traffic changes. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../network-policies/cidr-groups.yaml | 150 ++++++++++++++++++ .../network-policies/kustomization.yaml | 1 + 2 files changed, 151 insertions(+) create mode 100644 kubernetes/infrastructure/network-policies/cidr-groups.yaml diff --git a/kubernetes/infrastructure/network-policies/cidr-groups.yaml b/kubernetes/infrastructure/network-policies/cidr-groups.yaml new file mode 100644 index 00000000..0ee9df84 --- /dev/null +++ b/kubernetes/infrastructure/network-policies/cidr-groups.yaml @@ -0,0 +1,150 @@ +# Client networks as Cilium CIDR groups, referenced from CNPs via +# fromCIDRSet.cidrGroupRef. ULA + IPv4 only: the ISP-delegated GUA prefixes +# change and are not listed. +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-default +spec: + externalCIDRs: + - fd00::/64 + - 192.168.8.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-management +spec: + externalCIDRs: + - fd02:10::/64 + - 10.2.10.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-radius +spec: + externalCIDRs: + - fd02:11::/64 + - 10.2.11.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-video +spec: + externalCIDRs: + - 10.2.20.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-iot +spec: + externalCIDRs: + - fd02:30::/64 + - 10.2.30.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-server +spec: + externalCIDRs: + - fd02:40::/64 + - fd40::/64 + - 10.2.40.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-k8s-node +spec: + externalCIDRs: + - fd02:46::/64 + - 10.2.46.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-k8s-ingress +spec: + externalCIDRs: + - fd02:47::/64 + - 10.2.47.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-k8s-pod +spec: + externalCIDRs: + - fd02:48::/64 + - 10.2.48.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-privat +spec: + externalCIDRs: + - fd02:50::/64 + - 10.2.50.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-phone +spec: + externalCIDRs: + - 10.2.60.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-access +spec: + externalCIDRs: + - 10.2.70.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-vpn +spec: + externalCIDRs: + - 10.2.80.0/24 + - 192.168.32.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-guest +spec: + externalCIDRs: + - 10.2.90.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-multi-transfer +spec: + externalCIDRs: + - 10.2.122.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-multi-lan +spec: + externalCIDRs: + - 10.2.123.0/24 +--- +apiVersion: cilium.io/v2 +kind: CiliumCIDRGroup +metadata: + name: net-mutti +spec: + externalCIDRs: + - 10.2.200.0/24 diff --git a/kubernetes/infrastructure/network-policies/kustomization.yaml b/kubernetes/infrastructure/network-policies/kustomization.yaml index ea5327db..45de1b98 100644 --- a/kubernetes/infrastructure/network-policies/kustomization.yaml +++ b/kubernetes/infrastructure/network-policies/kustomization.yaml @@ -1,6 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - cidr-groups.yaml - default-deny.yaml - allow-ingress.yaml - ingress-isolation.yaml -- 2.54.0