93510c0703
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Failing after 1m38s
CD Pipeline / build-and-deploy (push) Has been skipped
CD Pipeline / post-deploy-checks (push) Has been skipped
330 lines
10 KiB
YAML
330 lines
10 KiB
YAML
# AWOOOI 正式環境零信任網路策略
|
||
# 負責人: CIO
|
||
# 版本: v1.8
|
||
# 日期: 2026-07-11
|
||
# 變更:
|
||
# - v1.8: SSH egress 僅允許 dedicated Ansible executor broker；修正 legacy allow 規則
|
||
# - v1.7: ADR-110 — 新增 GCP-A/GCP-B Ollama egress（GCP 三層容災）
|
||
# - v1.6: 新增 K3s node 120/121 SSH egress，供 SSH MCP 主機診斷/修復
|
||
# - v1.5: 新增 keepalived VIP 192.168.0.125/32 ArgoCD NodePort 30443 egress（修復 heartbeat probe）
|
||
# - v1.4: 新增 ArgoCD MCP egress（argocd namespace port 80/443）
|
||
# - v1.3: 新增 192.168.0.111 Ollama 主機 (M1 Pro)，移除 188 的 Ollama port
|
||
# - v1.2: 修復 DNS 規則使用 namespaceSelector (ADR-011 Appendix B)
|
||
# - v1.1: 新增 Langfuse LLMOps (192.168.0.110:3100) - Phase 15.1
|
||
#
|
||
# 原則: Default Deny All - 預設拒絕所有流量，僅白名單允許
|
||
|
||
# 1. 預設拒絕所有流量
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: default-deny-all
|
||
namespace: awoooi-prod
|
||
spec:
|
||
podSelector: {}
|
||
policyTypes:
|
||
- Ingress
|
||
- Egress
|
||
|
||
---
|
||
# 2. 允許 Nginx Gateway 與 K3s NodePort 的 Ingress 流量
|
||
# 注意: externalTrafficPolicy: Cluster 會導致 NodePort 流量源 IP 被 SNAT 為節點 IP
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: allow-nginx-ingress
|
||
namespace: awoooi-prod
|
||
spec:
|
||
podSelector: {}
|
||
policyTypes:
|
||
- Ingress
|
||
ingress:
|
||
# 允許來自 Nginx Gateway (188) 的直接流量
|
||
- from:
|
||
- ipBlock:
|
||
cidr: 192.168.0.188/32
|
||
ports:
|
||
- protocol: TCP
|
||
port: 3000
|
||
- protocol: TCP
|
||
port: 8000
|
||
# 允許 K3s NodePort 流量 (SNAT 後源 IP 變為節點 IP)
|
||
# 2026-04-05 Claude Code: 加入 110 — Alertmanager 需要從 110 送 webhook 到 API
|
||
- from:
|
||
- ipBlock:
|
||
cidr: 192.168.0.120/32 # K3s Master (mon)
|
||
- ipBlock:
|
||
cidr: 192.168.0.121/32 # K3s Worker (mon1)
|
||
- ipBlock:
|
||
cidr: 192.168.0.110/32 # DevOps 主機 (Alertmanager 來源)
|
||
ports:
|
||
- protocol: TCP
|
||
port: 3000
|
||
- protocol: TCP
|
||
port: 8000
|
||
# 允許 K3s 內部 Pod 網段 (健康檢查 + 叢集內部通訊)
|
||
- from:
|
||
- ipBlock:
|
||
cidr: 10.42.0.0/16 # K3s Pod CIDR
|
||
ports:
|
||
- protocol: TCP
|
||
port: 3000
|
||
- protocol: TCP
|
||
port: 8000
|
||
|
||
---
|
||
# 3. 允許訪問必要的外部服務 (Egress)
|
||
# 2026-03-23 修正: 使用 system: awoooi 匹配所有 Pods (API + Worker + Web)
|
||
# 教訓: app: awoooi-api 會排除 Worker (app: awoooi-worker)
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: allow-required-egress
|
||
namespace: awoooi-prod
|
||
spec:
|
||
podSelector:
|
||
matchLabels:
|
||
system: awoooi
|
||
policyTypes:
|
||
- Egress
|
||
egress:
|
||
# 允許訪問 192.168.0.188 主機服務 (AI+Web 中心)
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.188/32
|
||
ports:
|
||
# PostgreSQL (Host 直裝)
|
||
- protocol: TCP
|
||
port: 5432
|
||
# Redis Stack (Docker)
|
||
- protocol: TCP
|
||
port: 6380
|
||
# OpenClaw (clawbot Docker) - 2026-04-01 ogt: 修正為 8088 (clawbot-v5 使用 8088)
|
||
- protocol: TCP
|
||
port: 8088
|
||
# SigNoz UI (Docker)
|
||
- protocol: TCP
|
||
port: 3301
|
||
# ========== OTEL 神經連線 (P0 核心) ==========
|
||
# SigNoz OTEL Collector gRPC (Host 24317 -> Container 4317)
|
||
- protocol: TCP
|
||
port: 24317
|
||
# SigNoz OTEL Collector HTTP (Host 24318 -> Container 4318)
|
||
- protocol: TCP
|
||
port: 24318
|
||
# ClickHouse HTTP API (直接查詢)
|
||
- protocol: TCP
|
||
port: 8123
|
||
|
||
# 允許訪問 Ollama 主機群（GCP-A / GCP-B / Local HDD）
|
||
# 2026-04-08 ogt: 切換 Ollama 到 M1 Pro，速度從 0.45→40+ tok/s
|
||
# 2026-05-03 ogt: ADR-110 GCP 三層容災，主力移至 GCP SSD（9x 載速 + 2x 推理）
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 34.143.170.20/32 # GCP-A Ollama Primary (SSD)
|
||
- ipBlock:
|
||
cidr: 34.21.145.224/32 # GCP-B Ollama Secondary (SSD)
|
||
- ipBlock:
|
||
cidr: 192.168.0.111/32 # Local HDD Fallback (M1 Pro)
|
||
ports:
|
||
# Ollama LLM API
|
||
- protocol: TCP
|
||
port: 11434
|
||
|
||
# 允許訪問 192.168.0.110 DevOps 金庫 (Harbor + Sentry + Langfuse + SSH Repair + Monitoring)
|
||
# 2026-03-24 新增: Sentry Self-Hosted
|
||
# 2026-03-26 新增: Langfuse LLMOps (Phase 15.1)
|
||
# 2026-04-09 新增: SSH port 22 — repair-bot-110.sh 自動修復 (Bug #11 修正)
|
||
# 2026-04-09 新增: Grafana(3002) + Prometheus(9090) + Gitea(3001) — monitoring probe
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.110/32
|
||
ports:
|
||
# Sentry Self-Hosted HTTP API
|
||
- protocol: TCP
|
||
port: 9000
|
||
# Harbor Registry (CD pipeline 使用)
|
||
- protocol: TCP
|
||
port: 5000
|
||
# Langfuse LLMOps (Phase 15.1)
|
||
- protocol: TCP
|
||
port: 3100
|
||
# Grafana — monitoring probe + 監控工具卡片
|
||
- protocol: TCP
|
||
port: 3002
|
||
# Prometheus — monitoring probe + 監控工具卡片
|
||
- protocol: TCP
|
||
port: 9090
|
||
# Gitea — CI/CD 主倉 probe + monitoring
|
||
- protocol: TCP
|
||
port: 3001
|
||
# 2026-05-25 Codex: ADR-110 production Ollama proxy pool.
|
||
# 11435=GCP-A, 11436=GCP-B, 11437=Local 111 fallback.
|
||
- protocol: TCP
|
||
port: 11435
|
||
- protocol: TCP
|
||
port: 11436
|
||
- protocol: TCP
|
||
port: 11437
|
||
|
||
# 允許訪問 192.168.0.112 安全掃描服務
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.112/32
|
||
ports:
|
||
# Kali Scanner API
|
||
- protocol: TCP
|
||
port: 8080
|
||
|
||
# 允許 AWOOI API 將脫敏 Alertmanager 告警送到 99 Agent99 relay
|
||
# 2026-07-10 Codex: Agent99 SRE relay consumes sanitized JSON only, then
|
||
# queues allowlisted remediation via the 99-side control loop.
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.99/32
|
||
ports:
|
||
- protocol: TCP
|
||
port: 8787
|
||
|
||
# 允許訪問 K8s API 與 K3s control-plane services
|
||
# 2026-03-23 修復: Y 按鈕執行超時
|
||
# 重要: ClusterIP (10.43.0.1:443) 會路由到實際端點 (192.168.0.120:6443)
|
||
# 必須同時允許兩者，否則流量會被 192.168.0.0/16 排除規則阻擋
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 10.43.0.1/32 # K3s API Server ClusterIP
|
||
ports:
|
||
- protocol: TCP
|
||
port: 443
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.120/32 # K3s Master 實際 API Server 端點 + ArgoCD NodePort
|
||
ports:
|
||
- protocol: TCP
|
||
port: 6443
|
||
# ArgoCD MCP NodePort (2026-04-11): ClusterIP DNAT 跨 namespace 不穩定，改用 NodePort
|
||
- protocol: TCP
|
||
port: 30443
|
||
|
||
# keepalived VIP — ArgoCD NodePort 存取點
|
||
# 2026-04-14 Claude Sonnet 4.6: VIP=192.168.0.125 當前在 mon(120)，ARGOCD_URL 指向 VIP
|
||
# 修復: heartbeat _probe_argocd_sync() 連 VIP:30443 被 NetworkPolicy 擋（All connection attempts failed）
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.125/32 # keepalived VIP
|
||
ports:
|
||
- protocol: TCP
|
||
port: 30443
|
||
|
||
# 允許訪問 ArgoCD MCP（MCP Phase 3，2026-04-11）
|
||
# ArgoCD Server Pod 在 argocd namespace (10.42.0.252)，但 DNS 解析到 ClusterIP (10.43.16.201)
|
||
# 必須同時允許 namespace+pod selector（Pod IP）和 ClusterIP
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels:
|
||
kubernetes.io/metadata.name: argocd
|
||
podSelector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: argocd-server
|
||
- ipBlock:
|
||
cidr: 10.43.16.201/32 # argocd-server ClusterIP
|
||
ports:
|
||
- protocol: TCP
|
||
port: 8080
|
||
|
||
# 允許訪問 192.168.0.121 K3s Worker (mon1)
|
||
# 2026-04-09 新增: NodePort 32334(API)/32335(Web) 在 121 上，host probe 需要
|
||
# 2026-04-14 新增: 30443 — ArgoCD server pod 在 121，kube-proxy DNAT 從此節點
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.121/32
|
||
ports:
|
||
- protocol: TCP
|
||
port: 6443
|
||
- protocol: TCP
|
||
port: 30443
|
||
- protocol: TCP
|
||
port: 32334
|
||
- protocol: TCP
|
||
port: 32335
|
||
|
||
# 允許 DNS 解析
|
||
# 2026-03-26 修復: 使用 namespaceSelector 明確指定 kube-system
|
||
# ADR-011 Appendix B: CoreDNS 只有 k8s-app=kube-dns 標籤，不要加其他標籤要求
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels:
|
||
kubernetes.io/metadata.name: kube-system
|
||
podSelector:
|
||
matchLabels:
|
||
k8s-app: kube-dns
|
||
ports:
|
||
- protocol: UDP
|
||
port: 53
|
||
- protocol: TCP
|
||
port: 53
|
||
|
||
# 允許訪問外部 AI API (雲端備援: Gemini / Claude)
|
||
# ⚠️ 2026-03-29 首席架構師審查:
|
||
# - K8s NetworkPolicy 不支援 FQDN (域名)，僅支援 CIDR
|
||
# - Google/Anthropic API IP 範圍動態變化
|
||
# - 若限定 CIDR，API 變更時會中斷 AI 功能
|
||
# - 建議: 維持 0.0.0.0/0:443，透過 Egress Gateway 強化 (未來)
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 0.0.0.0/0
|
||
except:
|
||
# 排除內網
|
||
- 10.0.0.0/8
|
||
- 172.16.0.0/12
|
||
- 192.168.0.0/16
|
||
ports:
|
||
- protocol: TCP
|
||
port: 443
|
||
|
||
---
|
||
# 4. 只有 dedicated broker 可以連到 allowlisted host SSH endpoints。
|
||
# 其他 workload 即使帶 system=awoooi，也不會從 allow-required-egress 取得 port 22。
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: allow-ansible-executor-broker-ssh-egress
|
||
namespace: awoooi-prod
|
||
spec:
|
||
podSelector:
|
||
matchLabels:
|
||
app: awoooi-ansible-executor-broker
|
||
component: execution-broker
|
||
policyTypes:
|
||
- Egress
|
||
egress:
|
||
- to:
|
||
- ipBlock:
|
||
cidr: 192.168.0.110/32
|
||
- ipBlock:
|
||
cidr: 192.168.0.112/32
|
||
- ipBlock:
|
||
cidr: 192.168.0.120/32
|
||
- ipBlock:
|
||
cidr: 192.168.0.121/32
|
||
- ipBlock:
|
||
cidr: 192.168.0.188/32
|
||
ports:
|
||
- protocol: TCP
|
||
port: 22
|
||
|
||
---
|
||
# 5. Legacy namespace 沒有 allow 規則，因此由 default-deny 保持封鎖。
|
||
# Kubernetes NetworkPolicy 是 additive allow model；帶 namespaceSelector 且省略
|
||
# ports 會允許全部連線，不能用來表達 deny。
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: deny-legacy-access
|
||
namespace: awoooi-prod
|
||
spec:
|
||
podSelector: {}
|
||
policyTypes:
|
||
- Egress
|
||
egress: []
|