fix: make default network policy compatible with Cilium dataplane

charts/app-reverse-proxy/Chart.yaml

@@ -2,9 +2,9 @@ apiVersion: v2
 name: charts-app-reverse-proxy
 description: EcoVadis Helm chart for application exposed with nginx reverse proxy
 type: application
-version: 3.1.1
+version: 4.0.0
 appVersion: 1.16.0
 dependencies:
 - name: charts-core
-  version: 2.6.0
+  version: 3.0.0
   repository: "https://ecovadiscode.github.io/charts/"

charts/app-reverse-proxy/values.yaml

@@ -107,7 +107,6 @@ global:
   eventHubNetworkPolicyEnabled: false
   lnmElasticNetworkPolicyEnabled: false
   redisNetworkPolicyEnabled: true
-  redisCidr: "#{redisCidr}#"
   sqlNetworkPolicyEnabled: true
   servicebusNetworkPolicyEnabled: true
 

charts/core/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: charts-core
 description: A Helm chart for Kubernetes
 type: application
-version: 2.8.0
+version: 3.0.0

charts/core/templates/cilium-network-policy.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.global.defaultNetworkPolicyEnabled -}}
+{{/*
+  Egress to Node IPs. Kubernetes NetworkPolicy has no way to select a node, and
+  Cilium resolves node addresses to the `host` / `remote-node` identities, which
+  CIDR and ipBlock selectors never match. The ipBlock 0.0.0.0/0 rule in
+  network-policy.yaml therefore does NOT cover them, despite allowing every
+  address - a CIDR rule can only ever match the `world` identity.
+
+  Azure NPM allowed a pod to reach its own node implicitly, so this never had to
+  be stated. Cilium grants nothing to nodes implicitly.
+
+  The concrete dependency is Azure IMDS at 169.254.169.254, used for managed
+  identity. That address is link-local and resolves to `host`, so a toCIDR rule
+  would not match it either - toEntities is the only construct that works.
+  Workload Identity reaches AAD over 443 instead, which is `world` and already
+  allowed, but both paths are covered here.
+
+  Egress only. These pods sit behind Traefik on a ClusterIP Service, so nothing
+  arrives from a node address. A workload exposed directly through a
+  LoadBalancer or NodePort Service with externalTrafficPolicy: Cluster sees the
+  client SNATed to a node IP and would additionally need
+  `fromEntities: [host, remote-node]`.
+
+  Rendered under the same switch as the NetworkPolicy: a pod that is not policed
+  needs no CiliumNetworkPolicy either.
+
+  Reference:
+  https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy
+*/}}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ include "charts-core.fullname" . }}-node-egress
+  labels:
+    {{- include "charts-core.labels" . | nindent 4 }}
+    networkPolicyType: default
+spec:
+  endpointSelector:
+    matchLabels:
+      {{- include "charts-core.selectorLabels" . | nindent 6 }}
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+{{- end -}}

charts/core/templates/network-policy.yaml

@@ -37,6 +37,12 @@ spec:
     - from: #outside world - sentry, optimizely, etc
       - ipBlock:
           cidr: 0.0.0.0/0
+      # Cilium never matches Pod IPs through ipBlock, so without these peers
+      # in-cluster clients lose access to the ports below. Under NPM they change
+      # nothing: 0.0.0.0/0 already covers Pods. Reference:
+      # https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy
+      - namespaceSelector: {}
+      - podSelector: {}
       ports:
         - port: 443
         - port: 80
@@ -80,10 +86,17 @@ spec:
     - to: #outside world - sentry, optimizely, etc
         - ipBlock:
             cidr: 0.0.0.0/0
+        # Cilium never matches Pod IPs through ipBlock, so without these peers
+        # in-cluster destinations lose access to the ports below. Under NPM they
+        # change nothing: 0.0.0.0/0 already covers Pods.
+        # https://learn.microsoft.com/en-us/azure/aks/migrate-from-npm-to-cilium-network-policy
+        - namespaceSelector: {}
+        - podSelector: {}
       ports:
         - port: 443
         - port: 80
-        - port: 8433
+        - port: 8433  # DEPRECATED: typo for 8443, kept until confirmed unused
+        - port: 8443
         - port: 8000
         - port: 8200
         - port: 53