fix(netpol): gebruik werkelijke productie-namespaces en label-selectors

uittenbroekrobbert · uittenbroekrobbert · commit 95d083e65971 · 2026-05-21T10:16:59.000+02:00
Voorgaande versie verwees overal naar 'rig-system' en aanverwante
labels, maar die namespace bestaat niet op odcn-production. De kustomize-sops
CMP plugin schrijft alleen de top-level kustomization.yaml namespace om naar
ARGOCD_APP_NAMESPACE (rig-prd-operations); label-selectors binnen
NetworkPolicy ingress/egress regels blijven echter letterlijk staan en
matchten dus niets, waardoor de cross-tenant lek bleef bestaan.

Vier files herzien:
- postgresql-networkpolicy.yaml: namespace rig-prd-operations,
  ingress-rules op kubernetes.io/metadata.name=rig-prd-operations
  (platform: OPI + Keycloak + co-located) plus created-by=operations-manager
  (tenant-namespaces; oude pre-label-era tenants zijn handmatig gepatcht).
- default-deny-ingress.yaml: namespace rig-prd-operations.
- minio-networkpolicy.yaml: zelfde labelmodel; ingress controller bron
  is openshift-ingress (odcn) ipv ingress-nginx.
- vault-networkpolicy.yaml: idem. Vault wordt alleen door OPI consumed
  in rig-prd-operations.

Tenant-namespaces zonder created-by-label (rig-prd-amt, rig-prd-test)
zijn met kubectl label gepatcht voor backfill. rig-prd-example was leeg.
diff --git a/infrastructure/bootstrap/infrastructure/minio/config/overlays/odcn/network-policies/minio-networkpolicy.yaml b/infrastructure/bootstrap/infrastructure/minio/config/overlays/odcn/network-policies/minio-networkpolicy.yaml
@@ -2,50 +2,48 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: allow-minio-access
-  namespace: rig-system
+  namespace: rig-prd-operations
 spec:
   podSelector:
     matchLabels:
       app.kubernetes.io/name: minio
 
   ingress:
-    # Allow S3 API access from within the rig-system namespace
+    # Platform namespace itself (OPI co-located in rig-prd-operations).
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: rig-system
+              kubernetes.io/metadata.name: rig-prd-operations
       ports:
         - protocol: TCP
-          port: 9000  # MinIO S3 API
+          port: 9000  # S3 API
         - protocol: TCP
           port: 9001  # MinIO Console
 
-    # Allow S3 API access from tenant namespaces only.
-    # Tenant namespaces are stamped with `created-by: operations-manager`
-    # by OPI (see operations-manager/python/manifests/namespace.yaml.jinja);
-    # infra namespaces do not carry this label. This replaces the previous
-    # empty selector that exposed the S3 API to every namespace.
+    # Tenant namespaces (OPI-generated, stamped with `created-by:
+    # operations-manager`). Replaces the previous empty `namespaceSelector: {}`
+    # that exposed the S3 API to every namespace on the cluster.
     - from:
         - namespaceSelector:
             matchLabels:
               created-by: operations-manager
       ports:
         - protocol: TCP
-          port: 9000  # MinIO S3 API
+          port: 9000
 
-    # Allow ingress controller access
+    # OpenShift Router (ingress controller on odcn-production).
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
+              kubernetes.io/metadata.name: openshift-ingress
       ports:
         - protocol: TCP
           port: 9000
         - protocol: TCP
           port: 9001
 
   egress:
-    # Allow DNS resolution
+    # DNS resolution.
     - to:
         - namespaceSelector: {}
           podSelector:
@@ -57,11 +55,11 @@ spec:
         - protocol: TCP
           port: 53
 
-    # Allow metrics export
+    # Prometheus metrics scraping.
     - to:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: monitoring
       ports:
         - protocol: TCP
-          port: 9091  # Prometheus metrics
+          port: 9091
diff --git a/infrastructure/bootstrap/infrastructure/postgresql/database/overlays/odcn/network-policies/default-deny-ingress.yaml b/infrastructure/bootstrap/infrastructure/postgresql/database/overlays/odcn/network-policies/default-deny-ingress.yaml
@@ -2,30 +2,21 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: default-deny-ingress-postgres
-  namespace: rig-system
+  namespace: rig-prd-operations
 spec:
-  # Deny-by-default backstop for the PostgreSQL datastore pods only.
+  # Explicit deny-by-default backstop for the CNPG postgres pods. K8s
+  # NetworkPolicy semantics already make pods deny-by-default once any
+  # policy with policyTypes: [Ingress] selects them (the allow-postgres-*
+  # policies above do that), so this is redundant for current state. Kept
+  # as a self-documenting baseline: if a future change removes the allow
+  # policies, the postgres pods stay closed instead of falling back to
+  # cluster-default open.
   #
-  # IMPORTANT: rig-system is NOT a datastore-only namespace. In the odcn
-  # production bundle (infrastructure/bootstrap/clusters/odcn) the following
-  # also deploy into rig-system WITHOUT any NetworkPolicy:
-  #   - Keycloak (keycloak/controller + keycloak/config overlays)
-  #   - Redis    (redis/controller overlay)
-  # A cluster-wide `podSelector: {}` deny here would select those pods and,
-  # since no allow policy exists for them, black-hole all their ingress:
-  # OPI -> Keycloak / Redis, ingress-nginx -> Keycloak, tenant apps -> OIDC.
-  # That is a platform-wide outage worse than the cross-tenant exposure this
-  # PR closes. The selector is therefore scoped to the CNPG postgres pods.
+  # Scoped to the CNPG postgres pods only via cnpg.io/cluster, so it cannot
+  # accidentally black-hole co-located workloads in rig-prd-operations
+  # (Keycloak, MinIO, Redis, OPI).
   #
-  # For those pods this is redundant with allow-postgres-access /
-  # allow-postgres-monitoring (which already select the same pods and make
-  # them deny-by-default under Kubernetes NetworkPolicy semantics), but it
-  # is kept as an explicit, self-documenting baseline: if a future change
-  # removes the allow policies, the postgres pods stay closed instead of
-  # falling back to open.
-  #
-  # Egress is intentionally left unmanaged so this policy cannot break
-  # outbound traffic.
+  # Egress intentionally left unmanaged.
   podSelector:
     matchLabels:
       cnpg.io/cluster: rig-db
diff --git a/infrastructure/bootstrap/infrastructure/postgresql/database/overlays/odcn/network-policies/postgresql-networkpolicy.yaml b/infrastructure/bootstrap/infrastructure/postgresql/database/overlays/odcn/network-policies/postgresql-networkpolicy.yaml
@@ -2,29 +2,29 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: allow-postgres-access
-  namespace: rig-system
+  namespace: rig-prd-operations
 spec:
   podSelector:
     matchLabels:
-      # Match PostgreSQL cluster pods
       cnpg.io/cluster: rig-db
 
   ingress:
-    # Allow PostgreSQL access from within the rig-system namespace
+    # Platform namespace itself (OPI + Keycloak + co-located workloads in
+    # rig-prd-operations all reach Postgres intra-namespace). This namespace
+    # is bootstrap-created and intentionally does NOT carry the
+    # `created-by: operations-manager` label; matched by name instead.
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: rig-system
+              kubernetes.io/metadata.name: rig-prd-operations
       ports:
         - protocol: TCP
           port: 5432
 
-    # Allow PostgreSQL access from tenant namespaces only.
-    # Tenant namespaces are stamped with `created-by: operations-manager`
-    # by OPI (see operations-manager/python/manifests/namespace.yaml.jinja).
-    # Infra namespaces (rig-system, monitoring, ingress-nginx) do NOT carry
-    # this label, so ingress is scoped to tenant workloads instead of the
-    # previous empty selector that allowed every namespace in the cluster.
+    # Tenant namespaces (OPI-generated, stamped with `created-by:
+    # operations-manager` in operations-manager/python/manifests/
+    # namespace.yaml.jinja). Pre-label-era namespaces have been backfilled
+    # with this label so they continue to have access.
     - from:
         - namespaceSelector:
             matchLabels:
@@ -33,23 +33,8 @@ spec:
         - protocol: TCP
           port: 5432
 
-    # Allow PostgreSQL access from the operations-manager namespace.
-    # In odcn-production OPI runs in `rig-prd-operations` (see
-    # bootstrap/rig-system/kustomize/operations-manager/overlays/odcn-production/
-    # kustomization.yaml). That namespace is bootstrap-created and does not
-    # carry the `created-by: operations-manager` label (OPI doesn't generate
-    # its own namespace), so it needs an explicit name match. Without this
-    # rule OPI cannot reach `rig-db-rw:5432` and refuses to start.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: rig-prd-operations
-      ports:
-        - protocol: TCP
-          port: 5432
-
   egress:
-    # Allow DNS resolution (kube-dns / CoreDNS).
+    # DNS resolution (kube-dns / CoreDNS).
     - to:
         - namespaceSelector: {}
           podSelector:
@@ -61,16 +46,17 @@ spec:
         - protocol: TCP
           port: 53
 
-    # Allow intra-cluster traffic within rig-system: CNPG instance-to-instance
-    # replication / WAL streaming and the in-cluster MinIO S3 backup target.
+    # Intra-namespace traffic: CNPG instance-to-instance replication / WAL
+    # streaming, plus reach the co-located MinIO backup-destination pod for
+    # in-cluster backup targets.
     - to:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: rig-system
+              kubernetes.io/metadata.name: rig-prd-operations
 
-    # Allow HTTPS egress for off-cluster backup / WAL archive targets
-    # (object storage over TLS). Assumption: backups use an HTTPS S3
-    # endpoint; narrow this further if an in-cluster-only target is used.
+    # HTTPS egress for off-cluster backup / WAL archive targets if the
+    # barmanObjectStore in cluster.yaml ever points off-cluster. Narrow to a
+    # specific CIDR when a concrete target is known (see follow-up #82).
     - to:
         - ipBlock:
             cidr: 0.0.0.0/0
@@ -83,18 +69,18 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: allow-postgres-monitoring
-  namespace: rig-system
+  namespace: rig-prd-operations
 spec:
   podSelector:
     matchLabels:
       cnpg.io/cluster: rig-db
 
   ingress:
-    # Allow metrics scraping from monitoring namespace
+    # Prometheus exporter scrape from the monitoring namespace.
     - from:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: monitoring
       ports:
         - protocol: TCP
-          port: 9187  # PostgreSQL exporter port
+          port: 9187  # postgres-exporter
diff --git a/infrastructure/bootstrap/infrastructure/vault/config/overlays/odcn/network-policies/vault-networkpolicy.yaml b/infrastructure/bootstrap/infrastructure/vault/config/overlays/odcn/network-policies/vault-networkpolicy.yaml
@@ -2,42 +2,37 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: allow-vault-access
-  namespace: rig-system
+  namespace: rig-prd-operations
 spec:
   podSelector:
     matchLabels:
       app.kubernetes.io/name: vault
 
   ingress:
-    # Allow API access from within the rig-system namespace
+    # Platform namespace itself: Vault is consumed by OPI which co-locates in
+    # rig-prd-operations. No tenant workload needs Vault — the previous
+    # all-namespaces rule (`namespaceSelector: {}`) is intentionally removed.
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: rig-system
+              kubernetes.io/metadata.name: rig-prd-operations
       ports:
         - protocol: TCP
-          port: 8200  # Vault API port
+          port: 8200
         - protocol: TCP
-          port: 8201  # Vault cluster port
-
-    # NOTE: the previous rule allowed Vault API access from ALL namespaces
-    # (`namespaceSelector: {}`). Vault is only consumed by OPI in the
-    # rig-system namespace; no tenant workload needs Vault. The
-    # all-namespaces rule has been removed entirely so tenant pods can no
-    # longer reach the Vault API. Access is now limited to rig-system
-    # (rule above) and the ingress controller (rule below).
+          port: 8201  # cluster port for HA
 
-    # Allow ingress controller access
+    # OpenShift Router (ingress controller on odcn-production) for admin UI.
     - from:
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
+              kubernetes.io/metadata.name: openshift-ingress
       ports:
         - protocol: TCP
           port: 8200
 
   egress:
-    # Allow intra-cluster communication for Vault HA
+    # Intra-cluster Vault HA.
     - to:
         - podSelector:
             matchLabels:
@@ -46,7 +41,7 @@ spec:
         - protocol: TCP
           port: 8201
 
-    # Allow DNS resolution
+    # DNS resolution.
     - to:
         - namespaceSelector: {}
           podSelector:
@@ -58,7 +53,7 @@ spec:
         - protocol: TCP
           port: 53
 
-    # Allow outbound access for auto-unseal, if using cloud KMS
+    # Outbound for cloud KMS auto-unseal.
     - to:
         - ipBlock:
             cidr: 0.0.0.0/0
