tegwick
04897a149f
Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy, probes), provider failure classification and suppression, T04 unit and live proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.
78 lines
2.3 KiB
YAML
78 lines
2.3 KiB
YAML
# Default-deny plus the narrowest exceptions (EMAIL-WP-0004-T03).
|
|
#
|
|
# Reachability is part of the threat model: only user-engine may call the
|
|
# receiver, and egress is limited to DNS + the IONOS SMTP STARTTLS port.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: email-connect-default-deny
|
|
namespace: email-connect
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes: [Ingress, Egress]
|
|
# No rules: everything not permitted below is denied.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: email-connect-user-engine-ingress
|
|
namespace: email-connect
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: email-connect
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
# user-engine is the only approved sender. Adding a second caller is a
|
|
# deliberate change here and a matching credential binding.
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: user-engine
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: user-engine
|
|
ports:
|
|
- {protocol: TCP, port: 8080}
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: email-connect-egress
|
|
namespace: email-connect
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: email-connect
|
|
policyTypes: [Egress]
|
|
egress:
|
|
# Cluster DNS
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- {protocol: UDP, port: 53}
|
|
- {protocol: TCP, port: 53}
|
|
# IONOS SMTP STARTTLS only. No general internet egress.
|
|
# smtp.ionos.de resolves outside the cluster; CIDR is intentionally broad
|
|
# but port-locked to 587. Tighten to provider CIDRs if inventory is fixed.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
ports:
|
|
- {protocol: TCP, port: 587}
|