Network Segmentation Guide

# Step 1: Apply default-deny to every application namespace
# This NetworkPolicy denies ALL ingress and egress by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: moltbot-agents    # Apply to each namespace
spec:
  podSelector: {}              # Matches ALL pods in namespace
  policyTypes:
  - Ingress
  - Egress
  # No rules = deny all ingress and egress

---
# Allow DNS egress (required for service discovery)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: moltbot-agents
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

# Allow moltbot-agents to reach llm-gateway in llm-services namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-llm-gateway-egress
  namespace: moltbot-agents
spec:
  podSelector:
    matchLabels:
      app: moltbot-agent
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: llm-services
      podSelector:
        matchLabels:
          app: llm-gateway
    ports:
    - port: 8080
      protocol: TCP

# Deny: moltbot-agents → database namespace (agents never touch DB directly)
# Deny: moltbot-agents → monitoring namespace
# Allow: monitoring namespace → moltbot-agents (metrics scraping only)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-prometheus-scrape
  namespace: moltbot-agents
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - port: 9090   # metrics port only

# Istio: enforce STRICT mTLS cluster-wide
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
  namespace: istio-system   # Cluster-wide policy
spec:
  mtls:
    mode: STRICT    # Reject any non-mTLS connection

---
# AuthorizationPolicy: allow only specific service-to-service calls
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: moltbot-agent-authz
  namespace: moltbot-agents
spec:
  selector:
    matchLabels:
      app: moltbot-agent
  action: ALLOW
  rules:
  - from:
    - source:
        principals:
        - "cluster.local/ns/ingress-nginx/sa/ingress-nginx"  # Only ingress can call agents
  # All other callers: implicitly denied

---
# Cilium alternative: mTLS via CiliumNetworkPolicy with SPIFFE identity
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: moltbot-mtls-policy
spec:
  endpointSelector:
    matchLabels:
      app: moltbot-agent
  ingress:
  - fromEntities:
    - cluster   # Only in-cluster traffic
    toPorts:
    - ports:
      - port: "8080"
      rules:
        http: [{}]  # L7 inspection enabled

# Cilium FQDN-based egress: only allow specific external hosts
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: moltbot-agent-egress
  namespace: moltbot-agents
spec:
  endpointSelector:
    matchLabels:
      app: moltbot-agent
  egress:
  # Allow: LLM gateway (internal)
  - toEndpoints:
    - matchLabels:
        app: llm-gateway
    toPorts:
    - ports: [{port: "8080", protocol: TCP}]

  # Allow: specific external APIs (if using cloud LLM)
  - toFQDNs:
    - matchName: "api.openai.com"
    toPorts:
    - ports: [{port: "443", protocol: TCP}]

  # Block: everything else including:
  # - AWS metadata (169.254.169.254)
  # - Internal admin interfaces
  # - All other external IPs

  egressDeny:
  - toCIDRSet:
    - cidr: "169.254.169.254/32"   # Block cloud metadata API
    - cidr: "10.0.0.0/8"           # Block internal unless explicitly allowed above
      except:
      - cidr: "10.0.1.0/24"        # Allow: LLM gateway subnet