net-kingdom/sso-mfa/k8s/network-policies/netpol-sso.yaml

# NetworkPolicies for the sso namespace (Keycloak)
#
# Allowed paths:
#   INGRESS: Traefik (kube-system) → Keycloak :8080
#   EGRESS:  Keycloak → databases :5432 (PostgreSQL)
#   EGRESS:  Keycloak → mfa :8080 (privacyIDEA API)
#   EGRESS:  all pods → kube-dns :53 (UDP+TCP)
#
# Everything else is denied.

# ── Default deny all ingress and egress ──────────────────────────────────────
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: sso
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# ── Allow ingress from Traefik (K3s ingress controller) ─────────────────────
# Traefik terminates TLS; Keycloak listens on HTTP :8080 internally.
# Traefik pods are in kube-system with label app.kubernetes.io/name=traefik.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-from-traefik
  namespace: sso
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: traefik
      ports:
        - port: 8080
          protocol: TCP
---
# ── Allow egress to PostgreSQL ───────────────────────────────────────────────
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-to-postgres
  namespace: sso
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              net-kingdom/component: databases
      ports:
        - port: 5432
          protocol: TCP
---
# ── Allow egress to privacyIDEA ──────────────────────────────────────────────
# Keycloak calls the privacyIDEA REST API via the privacyIDEA Keycloak Provider.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-to-privacyidea
  namespace: sso
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              net-kingdom/component: mfa
      ports:
        - port: 8080
          protocol: TCP
---
# ── Allow egress DNS (all pods) ──────────────────────────────────────────────
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-dns
  namespace: sso
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP