@pleri/olam-cli 0.1.160 → 0.1.162

package/host-cp/peripheral-services/manifests/65-networkpolicy-loki-prom-deny.yaml

@@ -0,0 +1,67 @@
+# NetworkPolicy — monitoring namespace default-deny + same-namespace allow
+# (Phase A Task A9; companion to 60-networkpolicy-ingress.yaml)
+#
+# Loki + Prometheus + Grafana accept inbound ONLY from pods in the same
+# `monitoring` namespace (intra-stack: Promtail → Loki, Grafana → Loki + Prom,
+# kube-prometheus-stack scrape targets within the stack). Cross-namespace
+# traffic — including from `olam` (host-cp, kg-service, agent-memory) and
+# kube-system (Traefik) — is denied.
+#
+# Operator access pattern is `kubectl port-forward -n monitoring svc/grafana
+# 3000` (Decision 16). port-forward uses the kube-apiserver's exec channel,
+# NOT pod-to-pod networking, so it bypasses NetworkPolicy by design.
+#
+# Decision 17 forbids any IngressRoute / Ingress that exposes Loki / Prom /
+# Grafana from outside the cluster; audit:no-ingress-route enforces that at
+# commit time, and this NetworkPolicy is the runtime defense-in-depth layer
+# (caught even if the audit is bypassed or a Helm chart renders a route).
+#
+# Forward-declaration note: Loki + Prometheus land in Phase B/C. Until those
+# manifests add pods to the `monitoring` namespace, this policy applies to an
+# empty pod set and is a no-op. Phase B/C must label their pods so this
+# selector keeps matching (kube-prometheus-stack's default labels already
+# satisfy `kubernetes.io/metadata.name: monitoring` via namespace metadata).
+#
+# Enforcement requires NetworkPolicy-capable CNI (see 60-* doc block).
+# Threat mitigated: T7 (Grafana admin secret exfil) + secondary T6 mitigation.
+---
+# Forward-declare the monitoring namespace so the NetworkPolicy below has a
+# valid target. Phase B/C kube-prometheus-stack installs into this namespace
+# and may add labels — its install MUST NOT delete the namespace; Helm uses
+# `--create-namespace=false` once this manifest seeds it.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  labels:
+    kubernetes.io/metadata.name: monitoring
+    app.kubernetes.io/part-of: olam-observability
+    olam.io/phase: a
+    olam.io/task: a9
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: monitoring-default-deny
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: olam-observability
+    app.kubernetes.io/component: security-fence
+    olam.io/phase: a
+    olam.io/task: a9
+spec:
+  # Selects every pod in the monitoring namespace. Phase B/C pods (loki,
+  # prometheus, grafana, promtail, alertmanager — whatever the chart renders)
+  # all match this empty selector automatically.
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow inbound only from same-namespace pods. Cross-namespace traffic
+    # (olam services, kube-system Traefik, default ns) is denied — see header
+    # for why this is the correct posture (operator uses kubectl port-forward,
+    # which bypasses NetworkPolicy via the kube-apiserver exec channel).
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring