From e54ec10fd93daf9a6549ede5a2f0b025cea6942d Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Tue, 28 Jul 2026 19:12:11 +0200
Subject: [PATCH] fix(authentik): scope authentik-postgresql NetworkPolicy to
 internal access

Closes issue #37. The Bitnami postgresql subchart's auto-generated
NetworkPolicy restricted the port (5432) but not the source - any pod in
any namespace could reach it, since additive NetworkPolicy rules can't
restrict an existing permissive one, only the chart itself controls it
(hence not touched during the original #10 rollout).

Disabled via postgresql.primary.networkPolicy.enabled: false and replaced
with a scoped policy allowing only authentik-server and authentik-worker
(same namespace) on 5432, matching the pattern already used for the
matrix namespace's postgres access. No metrics exporter is enabled for
this instance, so no monitoring-namespace rule is needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 apps/authentik/authentik.yaml     |  5 +++++
 apps/authentik/networkpolicy.yaml | 33 ++++++++++++++++++++++++++++---
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/apps/authentik/authentik.yaml b/apps/authentik/authentik.yaml
index 0bb264d..5098bc4 100644
--- a/apps/authentik/authentik.yaml
+++ b/apps/authentik/authentik.yaml
@@ -98,3 +98,8 @@ spec:
             memory: 256Mi
           limits:
             memory: 512Mi
+        # Chart's own generated policy allows ANY pod in ANY namespace on 5432
+        # (see issue #37) - disabled in favor of our own scoped policy in
+        # apps/authentik/networkpolicy.yaml.
+        networkPolicy:
+          enabled: false
diff --git a/apps/authentik/networkpolicy.yaml b/apps/authentik/networkpolicy.yaml
index 00ebe4e..2881745 100644
--- a/apps/authentik/networkpolicy.yaml
+++ b/apps/authentik/networkpolicy.yaml
@@ -4,9 +4,10 @@
 # for upstream OIDC calls. Egress is intentionally untouched (federation-equivalent
 # outbound calls like SMTP aren't restricted here).
 #
-# Note: authentik-postgresql already has its own NetworkPolicy from the Bitnami
-# postgresql subchart (port 5432, no source restriction) - left alone, not duplicated,
-# since it would get reset on the next Helm upgrade anyway.
+# authentik-postgresql: the Bitnami postgresql subchart's own generated NetworkPolicy
+# restricted the port (5432) but not the source - any pod in any namespace could reach
+# it (issue #37). Disabled via postgresql.primary.networkPolicy.enabled: false in
+# authentik.yaml and replaced below with a policy scoped to authentik-server/-worker.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -47,6 +48,32 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: allow-ingress-authentik-postgresql
+  namespace: authentik
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgresql
+      app.kubernetes.io/component: primary
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: server
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+              app.kubernetes.io/component: worker
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: allow-ingress-acme-solver
   namespace: authentik