From 37dc17065dad8db842ad6ef88a39ab260f4b964e Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Sat, 7 Nov 2026 11:19:37 +0100
Subject: [PATCH] feat(coredns): restrict kube-dns-lb ingress to the internal
 networks

CoreDNS had no policy, so kube-dns-lb answered any source. The new CNP
allows the whole cluster on every port and the internal client networks
on 53/UDP+TCP. Selecting the pods makes them default-deny for ingress.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../network-policies/kube-system-coredns.yaml | 40 +++++++++++++++++++
 .../network-policies/kustomization.yaml       |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 kubernetes/infrastructure/network-policies/kube-system-coredns.yaml

diff --git a/kubernetes/infrastructure/network-policies/kube-system-coredns.yaml b/kubernetes/infrastructure/network-policies/kube-system-coredns.yaml
new file mode 100644
index 00000000..e61cf0a8
--- /dev/null
+++ b/kubernetes/infrastructure/network-policies/kube-system-coredns.yaml
@@ -0,0 +1,40 @@
+# CoreDNS is reachable from the LAN through the kube-dns-lb LoadBalancer
+# (ETP=Local, client address reaches the pod). Selecting the pods makes
+# them default-deny for ingress, so the whole cluster (pods, nodes, kubelet
+# probes, Prometheus) is allowed on every port; LAN clients only on 53.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: coredns-ingress
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  ingress:
+    - fromEntities:
+        - cluster
+    - fromCIDRSet:
+        - cidrGroupRef: net-default
+        - cidrGroupRef: net-management
+        - cidrGroupRef: net-radius
+        - cidrGroupRef: net-video
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-server
+        - cidrGroupRef: net-k8s-node
+        - cidrGroupRef: net-k8s-ingress
+        - cidrGroupRef: net-k8s-pod
+        - cidrGroupRef: net-privat
+        - cidrGroupRef: net-phone
+        - cidrGroupRef: net-access
+        - cidrGroupRef: net-vpn
+        - cidrGroupRef: net-guest
+        - cidrGroupRef: net-multi-transfer
+        - cidrGroupRef: net-multi-lan
+        - cidrGroupRef: net-mutti
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
diff --git a/kubernetes/infrastructure/network-policies/kustomization.yaml b/kubernetes/infrastructure/network-policies/kustomization.yaml
index 45de1b98..6fcf8fbc 100644
--- a/kubernetes/infrastructure/network-policies/kustomization.yaml
+++ b/kubernetes/infrastructure/network-policies/kustomization.yaml
@@ -41,3 +41,4 @@ resources:
   - allow-cilium-health.yaml
   - cnpg-barman-s3.yaml
   - kube-system-hubble-relay.yaml
+  - kube-system-coredns.yaml
-- 
2.54.0