Network and Port Reference

# Baseline: deny everything in the namespace, then allow DNS back.
#
# Apply this first. Without the DNS rule every pod fails to resolve service names and the
# platform appears to hang rather than fail, which is the single most common mistake when
# introducing NetworkPolicies.
#
# Replace `axual` with the namespace holding the platform.
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: axual
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: axual
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

# Governance layer. See "Governance layer" in the Network and Port Reference, which explains
# the Bitnami MySQL policy this one has to work around.
#
# Placeholders to replace before applying:
#
#   namespace: axual              the namespace holding the Governance components
#   app.kubernetes.io/instance    the Helm release name, `axual` below
#   kafka / connect               the namespaces holding the Streaming and Run-time layers
#   axual-kafka                   the Kafka resource name; strimzi.io/name is that plus `-kafka`
#   monitoring / ingress-nginx    the namespaces holding Prometheus and the ingress controller
---
# The API Gateway is the only entry point into the Governance layer, and it fans out to
# every other component.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-gateway
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: api-gateway
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-ui
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: topic-browse
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: metrics-exposer
      ports:
        - protocol: TCP
          port: 9080
---
# Platform Manager holds the platform state and reaches every backing service.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-manager
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-manager
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: topic-browse
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager-mysql
      ports:
        - protocol: TCP
          port: 3306
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager-vault
      ports:
        - protocol: TCP
          port: 8200
    # Cross-namespace peers: both selectors in one peer, so the rule is those pods only.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              app.kubernetes.io/name: apicurio-registry
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9093
    # Connector and KSML provisioning. Drop both if the Run-time layer is not deployed.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: connect
          podSelector:
            matchLabels:
              app.kubernetes.io/name: axual-connect
      ports:
        - protocol: TCP
          port: 11000
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: connect
          podSelector:
            matchLabels:
              app.kubernetes.io/name: runtime-provisioner
      ports:
        - protocol: TCP
          port: 8000
---
# Topic Browse reads topic data from Kafka and schemas from the registry, and asks Platform
# Manager for the connection details it needs.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: topic-browse
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: topic-browse
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              app.kubernetes.io/name: apicurio-registry
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9093
---
# The Platform UI serves static assets and initiates nothing, so it declares no egress.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-ui
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-ui
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
      ports:
        - protocol: TCP
          port: 8080
---
# The Metrics Exposer answers the Gateway on 9080 and queries Prometheus for the figures.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metrics-exposer
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: metrics-exposer
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
      ports:
        - protocol: TCP
          port: 9080
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 9090
---
# Keycloak. Browsers reach it directly through the ingress during the login redirect.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: keycloak
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-gateway
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
        # Apicurio Registry OIDC token validation, when its chart enables authentication.
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              app.kubernetes.io/name: apicurio-registry
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak-mysql
      ports:
        - protocol: TCP
          port: 3306
    # Upstream identity provider. Replace the CIDR, or drop the rule if none is configured.
    - to:
        - ipBlock:
            cidr: 203.0.113.0/24
      ports:
        - protocol: TCP
          port: 443
---
# Platform Manager's database. Needs `networkPolicy.enabled: false` on the subchart to take
# effect; see the Governance layer notes.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-manager-mysql
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-manager-mysql
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
      ports:
        - protocol: TCP
          port: 3306
---
# Keycloak's database, with the same caveat about the chart's own NetworkPolicy.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: keycloak-mysql
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak-mysql
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak
      ports:
        - protocol: TCP
          port: 3306
---
# Vault. Validates service account tokens through the Kubernetes API, hence the egress rule.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-manager-vault
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-manager-vault
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
      ports:
        - protocol: TCP
          port: 8200
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: connect
          podSelector:
            matchLabels:
              app.kubernetes.io/name: axual-connect
      ports:
        - protocol: TCP
          port: 8200
  egress:
    # Replace with the API server endpoint: the address behind the `kubernetes` Service.
    - to:
        - ipBlock:
            cidr: 198.51.100.0/32
      ports:
        - protocol: TCP
          port: 443

# Streaming layer. See "Streaming layer" in the Network and Port Reference.
#
# Placeholders to replace before applying:
#
#   namespace: kafka              the namespace holding the Streaming components
#   axual-kafka                   the Kafka resource name; strimzi.io/name is that plus `-kafka`
#   app.kubernetes.io/instance    the Helm release name, `axual` below
#   axual / connect               the namespaces holding the Governance and Run-time layers
#   ingress-nginx                 the namespace holding the ingress controller
#   10.0.0.0/8                    the address range reaching the external listeners
---
# Egress for the Kafka pods, which the Strimzi-generated policy does not cover. Both roles
# are selected together: a broker reaches the controller quorum on 9090 and its peers on
# 9091, and a controller reaches the other controllers on 9090.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kafka-egress
  namespace: kafka
spec:
  podSelector:
    matchLabels:
      strimzi.io/cluster: axual-kafka
      strimzi.io/kind: Kafka
      strimzi.io/name: axual-kafka-kafka
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9090
        - protocol: TCP
          port: 9091
---
# The Apicurio Registry stores schemas on a Kafka topic, so it is a Kafka client as well as
# a server. It serves 8080 and 8443 at the same time; its Service publishes them on 20500
# and 21500, but a NetworkPolicy matches the container ports.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: apicurio-registry
  namespace: kafka
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: apicurio-registry
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: topic-browse
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: rest-proxy
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: connect
      ports:
        - protocol: TCP
          port: 8080
    # Schema lookups by client applications, terminating TLS at the pod on 8443.
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - protocol: TCP
          port: 8443
  egress:
    - to:
        - podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9093
    # OIDC token validation against Keycloak, which lives in the Governance namespace. Drop
    # this rule when `security.authentication.enabled` is left off.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak
      ports:
        - protocol: TCP
          port: 8080
---
# The Rest Proxy serves its API over TLS on 18111 and its management endpoints on 8081.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: rest-proxy
  namespace: kafka
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: rest-proxy
      # The Rest Proxy chart sets the instance label to `<release>-rest-proxy`, where every
      # other chart on the platform sets it to the release name alone.
      app.kubernetes.io/instance: axual-rest-proxy
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/8
      ports:
        - protocol: TCP
          port: 18111
  egress:
    - to:
        - podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9093
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: apicurio-registry
      ports:
        - protocol: TCP
          port: 8080

# Run-time layer. See "Run-time layer" in the Network and Port Reference.
#
# Placeholders to replace before applying:
#
#   namespace: connect            the namespace holding the Run-time components
#   app.kubernetes.io/instance    the Helm release name, `axual` below
#   axual / kafka                 the namespaces holding the Governance and Streaming layers
#   axual-kafka                   the Kafka resource name; strimzi.io/name is that plus `-kafka`
#   strimzi                       the namespace running the Strimzi Cluster Operator
#   198.51.100.0/32               the Kubernetes API server endpoint
---
# Axual Connect accepts connector lifecycle calls from Platform Manager and reaches Kafka
# and Vault.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: axual-connect
  namespace: connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: axual-connect
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
      ports:
        - protocol: TCP
          port: 11000
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9093
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager-vault
      ports:
        - protocol: TCP
          port: 8200
---
# The Runtime Provisioner accepts application lifecycle calls from Platform Manager and creates
# KSML deployments through the Kubernetes API.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: runtime-provisioner
  namespace: connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: runtime-provisioner
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: axual
          podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-manager
      ports:
        - protocol: TCP
          port: 8000
  egress:
    # Replace the CIDR with the API server endpoint for the cluster. On a managed cluster
    # this is the address behind the `kubernetes` Service in the `default` namespace.
    - to:
        - ipBlock:
            cidr: 198.51.100.0/32
      ports:
        - protocol: TCP
          port: 443
---
# Axual Distributor runs as a Strimzi KafkaConnect resource, so Strimzi creates its pods and
# they carry Strimzi's labels. Unlike the Kafka resource, a KafkaConnect gets no generated
# NetworkPolicy, so the Cluster Operator's access to the REST API on 8083 has to be granted
# here. Without this rule the operator cannot manage connectors.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: distributor
  namespace: connect
spec:
  podSelector:
    matchLabels:
      strimzi.io/kind: KafkaConnect
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: strimzi
      ports:
        - protocol: TCP
          port: 8083
  egress:
    # The inter-cluster listener on the local cluster, present only when
    # `kafka.interClusterListener.enabled` is set.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kafka
          podSelector:
            matchLabels:
              strimzi.io/cluster: axual-kafka
              strimzi.io/kind: Kafka
              strimzi.io/name: axual-kafka-kafka
      ports:
        - protocol: TCP
          port: 9096
    # The destination cluster, which is outside this cluster. Replace the CIDR with the
    # address range of the remote brokers.
    - to:
        - ipBlock:
            cidr: 203.0.113.0/24
      ports:
        - protocol: TCP
          port: 9096

# Metrics scraping. See "Metrics scraping" in the Network and Port Reference, which explains
# why the Run-time policy has to be applied alongside this one.
#
# Placeholders to replace before applying:
#
#   axual / kafka / connect       the namespaces holding the three layers
#   monitoring                    the namespace running Prometheus
#   app.kubernetes.io/instance    the Helm release name, `axual` below
---
# Governance: the Spring Boot components share one management port, and Keycloak keeps its
# own management listener.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-governance
  namespace: axual
spec:
  podSelector:
    matchExpressions:
      - key: app.kubernetes.io/name
        operator: In
        values:
          - api-gateway
          - platform-manager
          - topic-browse
          - metrics-exposer
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 8086
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-keycloak
  namespace: axual
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 9000
---
# Streaming: the Apicurio Registry serves metrics on its API port rather than a separate
# management port, so this rule opens 8080 to the monitoring namespace.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-apicurio-registry
  namespace: kafka
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: apicurio-registry
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-rest-proxy
  namespace: kafka
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: rest-proxy
      # The Rest Proxy chart sets the instance label to `<release>-rest-proxy`, where every
      # other chart on the platform sets it to the release name alone.
      app.kubernetes.io/instance: axual-rest-proxy
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 8081
---
# Run-time: Axual Connect and the Runtime Provisioner each expose their own metrics port.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-axual-connect
  namespace: connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: axual-connect
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 5555
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-runtime-provisioner
  namespace: connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: runtime-provisioner
      app.kubernetes.io/instance: axual
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 2112
---
# Axual Distributor runs as a Strimzi KafkaConnect resource, so its pods carry Strimzi's
# labels. Selecting on the kind matches them without naming the tenant and instance the
# resource name is built from. The port exists only when `connect.metrics.enabled` is set.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-scrape-distributor
  namespace: connect
spec:
  podSelector:
    matchLabels:
      strimzi.io/kind: KafkaConnect
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 9404