authentik.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: authentik

---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-ingress
  namespace: authentik
spec:
  podSelector: {}
  ingress:
  - from:
    # Only allow ingress from nginx
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: nginx
  - from:
    # Allow local and operator ingress to PostgreSQL
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: authentik
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: postgres
    ports:
    - protocol: TCP
      port: 5432
      endPort: 5432
    - protocol: TCP
      port: 8008 #Patroni
      endPort: 8008
  - from:
    # Allow local ingress to Redis
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: authentik
    ports:
    - protocol: TCP
      port: 6379
      endPort: 6379
  - from:
    # Allow LDAP ingress
    - ipBlock:
        cidr: "10.0.0.0/8"
    - ipBlock:
        cidr: "192.0.0.0/8"
    ports:
    - protocol: TCP
      port: 3389
      endPort: 3389
    - protocol: TCP
      port: 6636
      endPort: 6636
  policyTypes:
  - Ingress

---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-egress
  namespace: authentik
spec:
  podSelector: {}
  egress:
  - to:
    # Allow all egress
    - ipBlock:
        cidr: "0.0.0.0/0"

  policyTypes:
  - Egress