feat: add default-deny network policies and security hardening

.github/workflows/ci.yaml

@@ -74,6 +74,8 @@ jobs:
           ksail-version: "7.12.2"
           init: "false"
           validate: "true"
+          scan: "true"
+          scan-framework: "nsa"
           sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
           hosts-file: ${{ vars.HOSTS_FILE }}
           root-ca-cert-file: ${{ vars.ROOT_CA_CERT_FILE }}

k8s/bases/apps/fleetdm/helm-release.yaml

@@ -13,6 +13,7 @@ spec:
     remediation:
       retries: -1
   upgrade:
+    force: true
     remediation:
       retries: -1
       remediateLastFailure: true
@@ -152,6 +153,9 @@ spec:
         existingSecret: mysql
       secondary:
         replicaCount: ${fleetdm_mysql_secondary_replicas:=2}
+        persistence:
+          enabled: true
+          size: 20Gi
       primary:
         persistence:
           enabled: true
@@ -179,11 +183,13 @@ spec:
         persistence:
           enabled: true
           size: 8Gi
+          storageClass: hcloud
       replica:
         replicaCount: ${fleetdm_redis_replicas:=2}
         persistence:
           enabled: true
           size: 8Gi
+          storageClass: hcloud
       metrics:
         enabled: true
         image:

k8s/bases/apps/fleetdm/kustomization.yaml

@@ -8,5 +8,6 @@ resources:
   - http-scaled-object.yaml
   - license-secret.yaml
   - mysql-secret.yaml
+  - networkpolicy.yaml
   - pod-disruption-budget.yaml
   - redis-secret.yaml

k8s/bases/apps/fleetdm/networkpolicy.yaml

@@ -0,0 +1,46 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-fleetdm
+  namespace: fleetdm
+spec:
+  endpointSelector: {}
+  ingress:
+    # Gateway ingress (direct from Cilium envoy)
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    # KEDA HTTP interceptor forwards traffic from gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: keda
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    # Intra-namespace (fleet → mysql, fleet → redis)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: fleetdm
+  egress:
+    # Intra-namespace (fleet → mysql, fleet → redis)
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: fleetdm
+    # Kube API
+    - toEntities:
+        - kube-apiserver
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

k8s/bases/apps/headlamp/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - helm-repository.yaml
   - httproute.yaml
   - http-scaled-object.yaml
+  - networkpolicy.yaml

k8s/bases/apps/headlamp/networkpolicy.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-headlamp
+  namespace: headlamp
+spec:
+  endpointSelector: {}
+  ingress:
+    # KEDA interceptor proxy routes traffic from gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: keda
+      toPorts:
+        - ports:
+            - port: "4466"
+              protocol: TCP
+  egress:
+    # Kube API for dashboard
+    - toEntities:
+        - kube-apiserver
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

k8s/bases/apps/homepage/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - httproute.yaml
   - namespace.yaml
   - pod-disruption-budget.yaml
+  - networkpolicy.yaml

k8s/bases/apps/homepage/networkpolicy.yaml

@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-homepage
+  namespace: homepage
+spec:
+  endpointSelector: {}
+  ingress:
+    # Traffic from oauth2-proxy (via gateway → oauth2-proxy → homepage)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: oauth2-proxy
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+  egress:
+    # Kube API for widget data
+    - toEntities:
+        - kube-apiserver
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

k8s/bases/apps/wedding-app/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - serviceaccount.yaml
   - sops-age-secret.enc.yaml
   - sync.yaml
+  - networkpolicy.yaml

k8s/bases/apps/wedding-app/networkpolicy.yaml

@@ -0,0 +1,56 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-wedding-app
+  namespace: wedding-app
+spec:
+  endpointSelector: {}
+  ingress:
+    # Gateway ingress
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+    # Intra-namespace (app → db, db replication)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: wedding-app
+    # CNPG operator needs to reach DB status endpoint (port 8000)
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cnpg-system
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+            - port: "5432"
+              protocol: TCP
+    # Metrics scraping from monitoring namespace
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: monitoring
+      toPorts:
+        - ports:
+            - port: "9187"
+              protocol: TCP
+  egress:
+    # Intra-namespace (app → db)
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: wedding-app
+    # Kube API (for CNPG operator managing the cluster)
+    - toEntities:
+        - kube-apiserver
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

k8s/bases/apps/whoami/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - helm-repository.yaml
   - httproute.yaml
   - http-scaled-object.yaml
+  - networkpolicy.yaml

k8s/bases/apps/whoami/networkpolicy.yaml

@@ -0,0 +1,28 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-whoami
+  namespace: whoami
+spec:
+  endpointSelector: {}
+  ingress:
+    # KEDA interceptor proxy routes traffic from gateway
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: keda
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+  egress:
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP

k8s/bases/infrastructure/cluster-policies/best-practices/add-default-deny.yaml

@@ -0,0 +1,76 @@
+# Generates a default-deny CiliumNetworkPolicy and a DNS-allow policy
+# in every namespace. This ensures zero-trust networking by default —
+# workloads must explicitly allow the traffic they need.
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-default-deny
+  annotations:
+    policies.kyverno.io/title: Default Deny Network Policy
+    policies.kyverno.io/category: Networking, Best Practices
+    policies.kyverno.io/subject: CiliumNetworkPolicy
+    policies.kyverno.io/minversion: 1.6.0
+    policies.kyverno.io/description: >-
+      Generates a CiliumNetworkPolicy that activates Cilium's whitelist
+      mode for all endpoints in a namespace (effectively deny-all), plus
+      a companion policy that allows DNS egress to kube-dns so pods can
+      still resolve names.
+spec:
+  rules:
+    - name: generate-default-deny
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              names:
+                - kube-system
+                - kube-public
+                - kube-node-lease
+      generate:
+        generateExisting: true
+        apiVersion: cilium.io/v2
+        kind: CiliumNetworkPolicy
+        name: default-deny
+        synchronize: true
+        namespace: "{{request.object.metadata.name}}"
+        data:
+          spec:
+            endpointSelector: {}
+    - name: generate-allow-dns
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+      exclude:
+        any:
+          - resources:
+              names:
+                - kube-system
+                - kube-public
+                - kube-node-lease
+      generate:
+        generateExisting: true
+        apiVersion: cilium.io/v2
+        kind: CiliumNetworkPolicy
+        name: allow-dns
+        synchronize: true
+        namespace: "{{request.object.metadata.name}}"
+        data:
+          spec:
+            endpointSelector: {}
+            egress:
+              - toEndpoints:
+                  - matchLabels:
+                      k8s:io.kubernetes.pod.namespace: kube-system
+                      k8s-app: kube-dns
+                toPorts:
+                  - ports:
+                      - port: "53"
+                        protocol: UDP
+                      - port: "53"
+                        protocol: TCP

k8s/bases/infrastructure/cluster-policies/best-practices/add-ns-quota.yaml

@@ -38,10 +38,10 @@ spec:
         data:
           spec:
             hard:
-              requests.cpu: "4"
+              requests.cpu: "8"
               requests.memory: 16Gi
-              limits.cpu: "4"
-              limits.memory: 16Gi
+              limits.cpu: "16"
+              limits.memory: 32Gi
     - name: generate-limitrange
       match:
         any:
@@ -68,8 +68,8 @@ spec:
             limits:
               - default:
                   cpu: 500m
-                  memory: 1Gi
+                  memory: 512Mi
                 defaultRequest:
-                  cpu: 200m
-                  memory: 256Mi
+                  cpu: 50m
+                  memory: 128Mi
                 type: Container