feat(distribution): add network policies

Makefile

@@ -94,6 +94,20 @@ generate-docs:
 	@md-gen gen --input schemas/public/kfddistribution-kfd-v1alpha2.json --output docs/schemas/kfddistribution-kfd-v1alpha2.md --overwrite --banner banners/kfddistribution.md
 	@md-gen gen --input schemas/public/ekscluster-kfd-v1alpha2.json --output docs/schemas/ekscluster-kfd-v1alpha2.md --overwrite --banner banners/ekscluster.md
 
+.PHONY: generate-np-diagrams
+generate-np-diagrams:
+	docker run --rm -v $(PWD)/docs/network-policies:/workdir minlag/mermaid-cli:latest -i "/workdir/overview.md" -o "/workdir/overview.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/auth:/workdir minlag/mermaid-cli:latest -i "/workdir/sso.md" -o "/workdir/sso.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/ingress:/workdir minlag/mermaid-cli:latest -i "/workdir/single.md" -o "/workdir/single.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/ingress:/workdir minlag/mermaid-cli:latest -i "/workdir/dual.md" -o "/workdir/dual.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/logging:/workdir minlag/mermaid-cli:latest -i "/workdir/loki.md" -o "/workdir/loki.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/logging:/workdir minlag/mermaid-cli:latest -i "/workdir/opensearch.md" -o "/workdir/opensearch.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/monitoring:/workdir minlag/mermaid-cli:latest -i "/workdir/mimir.md" -o "/workdir/mimir.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/monitoring:/workdir minlag/mermaid-cli:latest -i "/workdir/prometheus.md" -o "/workdir/prometheus.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/opa:/workdir minlag/mermaid-cli:latest -i "/workdir/gatekeeper.md" -o "/workdir/gatekeeper.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/opa:/workdir minlag/mermaid-cli:latest -i "/workdir/kyverno.md" -o "/workdir/kyverno.png" -w 2048 -H 1536 -b white
+	docker run --rm -v $(PWD)/docs/network-policies/modules/tracing:/workdir minlag/mermaid-cli:latest -i "/workdir/tempo.md" -o "/workdir/tempo.png" -w 2048 -H 1536 -b white
+
 .PHONY: dump-private-schema
 dump-private-schema:
 	@cat schemas/public/ekscluster-kfd-v1alpha2.json | \

defaults/ekscluster-kfd-v1alpha2.yaml

@@ -15,7 +15,6 @@ data:
     relativeVendorPath: "../../vendor"
     provider:
       type: eks
-
   # the module section will be used to fine tune each module behaviour and configuration
   modules:
     # ingress module configuration

defaults/kfddistribution-kfd-v1alpha2.yaml

@@ -15,7 +15,6 @@ data:
     relativeVendorPath: "../../vendor"
     provider:
       type: none
-
   # the module section will be used to fine tune each module behaviour and configuration
   modules:
     # ingress module configuration

defaults/onpremises-kfd-v1alpha2.yaml

@@ -15,7 +15,7 @@ data:
     relativeVendorPath: "../../vendor"
     provider:
       type: none
-
+    networkPoliciesEnabled: false
   # the module section will be used to fine tune each module behaviour and configuration
   modules:
     # ingress module configuration

docs/network-policies/README.md

@@ -0,0 +1,24 @@
+# Network Policies Documentation
+
+This documentation describes all Network Policies of the KFD components for the OnPremises schema.
+
+## Modules
+- [Auth](modules/auth/README.md) - Pomerium SSO
+- [Ingress](modules/ingress/README.md) - Nginx (single/dual) + Cert-manager
+- [Logging](modules/logging/README.md) - OpenSearch/Loki
+- [Monitoring](modules/monitoring/README.md) - Prometheus/Mimir
+- [OPA](modules/opa/README.md) - Gatekeeper/Kyverno
+- [Tracing](modules/tracing/README.md) - Tempo
+
+## Common Patterns
+All namespaces include:
+- Default deny-all policy
+- DNS access to kube-dns
+- Prometheus metrics collection
+- Kubernetes API server access where needed
+
+## High Level Overview
+- [Overview](overview.md)
+
+## Instructions
+Generate the new Network Policies diagrams with `make generate-np-diagrams`.

docs/network-policies/modules/auth/README.md

@@ -0,0 +1,16 @@
+# Auth Module Network Policies
+
+## Components
+- Pomerium
+
+## Namespaces
+- pomerium
+
+## Network Policies List
+- deny-all
+- all-egress-kube-dns
+- pomerium-ingress-nginx
+- pomerium-egress-all
+
+## Configurations
+- [SSO with Pomerium](sso.md)

docs/network-policies/modules/auth/sso.md

@@ -0,0 +1,53 @@
+# SSO with Pomerium
+
+```mermaid
+graph TD
+    %% Namespaces
+    subgraph ingress-nginx
+        nginx[Nginx Controller]
+    end
+
+    subgraph pomerium
+        pom[Pomerium<br/>app: pomerium]
+        acme[ACME HTTP Solver<br/>app: cert-manager]
+    end
+
+    subgraph monitoring
+        graf[Grafana]
+        prom[Prometheus]
+        am[Alertmanager]
+        minio_monitoring[MinIO]
+    end
+
+    subgraph logging
+        osd[OpenSearch Dashboards]
+        minio_logging[MinIO]
+    end
+
+    subgraph tracing
+        minio_tracing[MinIO]
+    end
+
+    subgraph gatekeer-system
+        gpm[Gatekeeper Policy Manager]
+    end
+
+    %% External and K8s Core Components
+    dns[Kube DNS]
+    ext[External]
+
+    %% Edges
+    pom -->|"53/UDP"| dns
+    nginx -->|"8080/TCP"| pom
+    nginx -->|"8089/TCP"| acme
+    prom -->|"9090/TCP metrics"| pom
+    pom -->|"443/TCP"| ext
+    pom -->|"3000/TCP"| graf
+    pom -->|"9090/TCP"| prom
+    pom -->|"9093/TCP"| am
+    pom -->|"5601/TCP"| osd
+    pom -->|"9001/TCP"| minio_logging
+    pom -->|"9001/TCP"| minio_tracing
+    pom -->|"9001/TCP"| minio_monitoring
+    pom -->|"8080/TCP"| gpm
+```

docs/network-policies/modules/ingress/README.md

@@ -0,0 +1,35 @@
+# Ingress Module Network Policies
+
+## Components
+- Nginx Ingress Controller (single/dual mode)
+- Cert-manager
+- Forecastle
+
+## Namespaces
+- ingress-nginx
+- cert-manager
+
+## Network Policies List
+
+### Cert-manager
+- deny-all
+- all-egress-kube-dns
+- cert-manager-egress-kube-apiserver
+- cert-manager-webhook-ingress-kube-apiserver
+- cert-manager-egress-https
+- cert-manager-ingress-prometheus-metrics
+- acme-http-solver-ingress-lets-encrypt
+
+### Ingress-nginx
+- deny-all
+- all-egress-kube-dns
+- forecastle-ingress-nginx
+- forecastle-egress-kube-apiserver
+- nginx-egress-all
+- all-ingress-nginx
+- nginx-ingress-prometheus-metric
+- external-dns
+
+## Configurations
+- [Single Nginx](single.md)
+- [Dual Nginx](dual.md)

docs/network-policies/modules/ingress/dual.md

@@ -0,0 +1,33 @@
+# Dual Nginx Configuration
+
+```mermaid
+graph TD
+    %% Namespaces
+    subgraph ingress-nginx
+        nginx[Nginx Controller<br/>app: ingress]
+        fc[Forecastle<br/>app: forecastle]
+    end
+
+    subgraph cert-manager
+        cm[Cert Manager<br/>app: cert-manager]
+        cmw[Cert Manager Webhook]
+    end
+
+    %% External and K8s Core Components
+    dns[Kube DNS]
+    api[Kubernetes API]
+    prom[Prometheus]
+    ext[External ACME / Internet]
+
+    %% Edges
+    nginx & cm -->|"53/UDP"| dns
+    cm -->|"6443/TCP"| api
+    fc -->|"6443/TCP"| api
+    api -->|"10250/TCP"| cmw
+    prom -->|"10254/TCP"| nginx
+    prom -->|"9402/TCP"| cm
+    cm -->|"443,80/TCP"| ext
+    all[All Namespaces] -->|"8080,8443,9443/TCP"| nginx
+    nginx -->|"egress: all"| all
+    nginx -->|"3000/TCP"| fc
+```

docs/network-policies/modules/ingress/single.md

@@ -0,0 +1,35 @@
+# Single Nginx Configuration
+
+```mermaid
+graph TD
+    %% Namespaces
+    subgraph ingress-nginx
+        nginx[Nginx Controller<br/>app: ingress-nginx]
+        fc[Forecastle<br/>app: forecastle]
+        edns[ExternalDNS<br/>app: external-dns]
+    end
+
+    subgraph cert-manager
+        cm[Cert Manager<br/>app: cert-manager]
+        cmw[Cert Manager Webhook]
+    end
+
+    %% External and K8s Core Components
+    dns[Kube DNS]
+    api[Kubernetes API]
+    prom[Prometheus]
+    ext[External / ACME]
+
+    %% Edges
+    nginx & cm -->|"53/UDP"| dns
+    cm -->|"6443/TCP"| api
+    fc -->|"6443/TCP"| api
+    api -->|"10250/TCP"| cmw
+    prom -->|"10254/TCP"| nginx
+    prom -->|"9402/TCP"| cm
+    cm -->|"443,80/TCP"| ext
+    all[All Namespaces] -->|"8080,8443,9443/TCP"| nginx
+    nginx -->|"egress: all"| all
+    nginx -->|"3000/TCP"| fc
+    edns --> |"egress: all"| ext
+```

docs/network-policies/modules/logging/README.md

@@ -0,0 +1,53 @@
+# Logging Module Network Policies
+
+## Components
+- OpenSearch Stack
+- Loki Stack
+
+## Namespaces
+- logging
+
+## Network Policies List
+
+### Common Policies
+- deny-all
+- all-egress-kube-dns
+- event-tailer-egress-kube-apiserver
+- fluentd-egress-all
+- fluentbit-egress-fluentd
+- fluentbit-egress-kube-apiserver
+- fluentbit-ingress-prometheus-metrics
+- logging-operator-egress-kube-apiserver
+
+### OpenSearch Stack
+- fluentd-ingress-fluentbit
+- fluentd-ingress-prometheus-metrics
+- opensearch-discovery
+- opensearch-ingress-dashboards
+- opensearch-ingress-fluentd
+- opensearch-ingress-prometheus-metrics
+- opensearch-ingress-jobs
+- opensearch-dashboards-egress-opensearch
+- opensearch-dashboards-ingress-nginx
+- opensearch-dashboards-ingress-jobs
+- jobs-egress-opensearch
+
+### Loki Stack
+- loki-distributed-ingress-fluentd
+- loki-distributed-ingress-grafana
+- loki-distributed-ingress-prometheus-metrics
+- loki-distributed-discovery
+- loki-distributed-egress-all
+
+### MinIO
+- minio-ingress-namespace
+- minio-buckets-setup-egress-kube-apiserver
+- minio-buckets-setup-egress-minio
+- minio-ingress-prometheus-metrics
+- minio-ingress-nginx
+- minio-egress-https
+
+## Configurations
+- [OpenSearch Stack](opensearch.md)
+- [Loki Stack](loki.md)
+

docs/network-policies/modules/logging/loki.md

@@ -0,0 +1,52 @@
+# Loki Stack Configuration
+
+```mermaid
+graph TD
+    %% Namespaces
+    subgraph logging
+        fb[Fluentbit<br/>app.kubernetes.io/name: fluentbit]
+        fd[Fluentd<br/>app.kubernetes.io/name: fluentd]
+        loki_gateway[Loki Gateway<br/>app.kubernetes.io/component: gateway]
+        loki_compactor[Loki Compactor<br/>app.kubernetes.io/component: compactor]
+        loki_distributor[Loki Distributor<br/>app.kubernetes.io/component: distributor]
+        loki_ingester[Loki Ingester<br/>app.kubernetes.io/component: ingester]
+        loki_querier[Loki Querier<br/>app.kubernetes.io/component: querier]
+        loki_query_frontend[Loki Query Frontend<br/>app.kubernetes.io/component: query-frontend]
+        minio[MinIO<br/>app: minio]
+        bucket[MinIO Bucket Setup<br/>app: minio-logging-buckets-setup]
+    end
+
+    subgraph monitoring
+        prom[Prometheus]
+        graf[Grafana]
+    end
+
+    pom[Pomerium]
+
+    %% External and K8s Core Components
+    api[Kubernetes API]
+    ext[External]
+    dns[Kube DNS]
+
+    %% Edges
+    logging -->|"53/UDP"| dns
+    bucket -->|"6443/TCP"| api
+    fb -->|"24240/TCP"| fd
+    fd -->|"8080/TCP"| loki_gateway
+    prom -->|"3100/TCP"| loki_gateway
+    graf -->|"8080/TCP"| loki_gateway
+    prom -->|"2020/TCP"| fb
+    fb -->|"6443/TCP"| api 
+    loki_query_frontend -->|"loki-discovery<br/>9095,7946,3100/TCP"| loki_distributor
+    loki_distributor -->|"loki-discovery<br/>9095,7946,3100/TCP"| loki_ingester
+    loki_querier -->|"loki-discovery<br/>9095,7946,3100/TCP"| loki_ingester
+    loki_querier -->|"loki-discovery<br/>9095,7946,3100/TCP"| loki_query_frontend
+    loki_compactor -->|"loki-discovery<br/>9095,7946,3100/TCP"| loki_ingester
+    loki_compactor -->|"egress: all"| minio
+    loki_ingester -->|"egress: all"| minio
+    loki_querier -->|"egress: all"| minio
+    bucket -->|"9000/TCP"| minio
+    minio -->|"443/TCP"| ext
+    pom -->|"9001/TCP"| minio
+    minio -->|"9000/TCP"| logging
+```