Thore Cimbal
3054037480
Second port-config incident from this rollout: synapse calls MAS's oauth2/introspect endpoint on port 8080 (not 8081 as assumed) for every single authenticated request (sync, pushrules, capabilities, etc). The rule only allowed kube-system (Traefik) on 8080, so every authenticated API call failed with 503 "Unable to introspect the access token" - all clients showed a lost connection. Patched live immediately, this commit brings Git back in sync with that patch.
294 lines
7.7 KiB
YAML
294 lines
7.7 KiB
YAML
# Default-deny ingress for the matrix namespace, with explicit allow rules per component.
|
|
# Egress is intentionally untouched (federation to arbitrary Matrix servers, ACME, SMTP,
|
|
# DNS all stay unrestricted).
|
|
#
|
|
# Lesson learned deploying the authentik namespace's equivalent policy: NetworkPolicy
|
|
# filters on the pod's actual container port, not the Service's external port (e.g.
|
|
# authentik-server's Service maps 80->9000). Wherever a Service here uses a *named*
|
|
# targetPort, this file references that name directly instead of guessing a number -
|
|
# Kubernetes resolves it from the pod spec, which is safer than a hardcoded port.
|
|
#
|
|
# matrix-stack-postgres already effectively has no dedicated chart NetworkPolicy of its
|
|
# own (unlike authentik-postgresql's Bitnami one) - the rules below are the only gate.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-ingress
|
|
namespace: matrix
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
---
|
|
# axion1337.chat (root) -> Element Web
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-web
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: element-web
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: element
|
|
---
|
|
# admin.axion1337.chat -> Element Admin
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-admin
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: element-admin
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
---
|
|
# axion1337.chat/docs/setup -> Element desktop setup docs (our own nginx)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-web-docs
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: element-web-docs
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
---
|
|
# matrix.axion1337.chat AND the well-known delegation both front through haproxy
|
|
# (matrix-stack-synapse and matrix-stack-well-known Services both target haproxy's
|
|
# named ports, not synapse-main directly).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-haproxy
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: haproxy
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: haproxy-synapse
|
|
- protocol: TCP
|
|
port: haproxy-403
|
|
- protocol: TCP
|
|
port: haproxy-wkd
|
|
---
|
|
# account.axion1337.chat (Traefik) + matrix.axion1337.chat (also routes to MAS for some
|
|
# paths) + synapse-main calling MAS's internal port for session/token introspection.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-mas
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8081
|
|
---
|
|
# Synapse itself: reached via haproxy (same namespace), calls from MAS (provisioning),
|
|
# metrics scraped by Alloy (monitoring namespace).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-synapse
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: haproxy
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
ports:
|
|
- protocol: TCP
|
|
port: synapse-http
|
|
- protocol: TCP
|
|
port: synapse-health
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: synapse-metrics
|
|
---
|
|
# mrtc.axion1337.chat (Traefik) for the auth handshake, plus Alloy scraping metrics.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-rtc-authorisation-service
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-authorisation-service
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-sfu
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
---
|
|
# The SFU: mrtc.axion1337.chat (Traefik) for signalling, Alloy for metrics, and the
|
|
# NodePort-exposed WebRTC media ports need to stay open to the internet by design -
|
|
# that's the actual point of a TURN/SFU media relay, not a mistake.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-rtc-sfu
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-sfu
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: metrics
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
ports:
|
|
- protocol: TCP
|
|
port: 30001
|
|
- protocol: UDP
|
|
port: 30002
|
|
---
|
|
# Postgres: only Synapse and MAS need data access; Alloy scrapes the exporter.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-postgres
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgres
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9187
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-acme-solver
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
acme.cert-manager.io/http01-solver: "true"
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8089
|
|
|
|
# Note: coturn runs with hostNetwork: true, so NetworkPolicy does not apply to it at all -
|
|
# it's already gated by the Hetzner Cloud Firewall instead. Nothing to write here.
|