# Default-deny ingress for the CA namespace, then three narrow allowances.
#
# Without this, the REST API on 8443 is reachable from every pod in the cluster.
# It is still client-cert authenticated, so this is defence in depth rather than
# the only control — but "the only thing standing between any compromised pod and
# a certificate factory is one TLS handshake" is not a position to be in.
#
# PREREQUISITE: microk8s needs a CNI that enforces NetworkPolicy. The default
# (Calico) does. If you are on flannel without a policy plugin these objects
# apply cleanly and silently enforce NOTHING — verify with the test in
# README.md § Verify the network policy rather than assuming.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: vnc-ca
spec:
  podSelector: {}
  policyTypes: [Ingress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-public-web-from-ingress
  namespace: vnc-ca
spec:
  podSelector:
    matchLabels:
      app: ejbca
  policyTypes: [Ingress]
  ingress:
    # Port 8080 (CRL/OCSP) from the ingress controller only.
    # VERIFY THE NAMESPACE: microk8s' nginx addon has historically used
    # `ingress`, `kube-system`, and `ingress-nginx` depending on version.
    #   kubectl get pods -A | grep -i ingress
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress
      ports:
        - port: 8080
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-rest-from-vncmail
  namespace: vnc-ca
spec:
  podSelector:
    matchLabels:
      app: ejbca
  policyTypes: [Ingress]
  ingress:
    # Port 8443 (REST API) from the webmail namespace only. This is the
    # enrolment route calling the CA with its RA client certificate.
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vncmail
      ports:
        - port: 8443
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-db-from-ejbca
  namespace: vnc-ca
spec:
  podSelector:
    matchLabels:
      app: ejbca-db
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: ejbca
      ports:
        - port: 3306
          protocol: TCP