Tighten RemoteDesktop network policies

apps/fc-desktop/network-policies.yaml

@@ -20,9 +20,12 @@
 # 1) desktop-isolation — Browser Lab session pods.
 #
 # Locks down pods labeled `app.kubernetes.io/name=remote-desktop` (every
-# session pod regardless of template). Allows guacd ingress for the VNC/RDP
-# display lane and remotedesktop-web's pre-handoff probing. Egress: NFS to
-# Synology, DNS, Traefik (cluster + LB VIP), Intranet (Browser Lab home).
+# session pod regardless of template). Allows guacd ingress for the display
+# lane and remotedesktop-web's pre-handoff probing. Egress is deliberately
+# narrow: named CoreDNS, direct Intranet web, and noc1 step-ca only. There is
+# no broad Traefik/VIP or internet egress from desktop sessions. If a future
+# Browser Lab path needs a public-style host, prefer an explicit Service rule
+# or include the post-DNAT backend port per the Traefik VIP lint.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -65,51 +68,22 @@ spec:
         - port: 5901
           protocol: TCP
   egress:
-    # NFS to Synology
+    # CoreDNS only. The old to: [] DNS rule accidentally allowed any DNS
+    # listener in any namespace or routed network.
     - to:
-        - ipBlock:
-            cidr: 10.0.58.3/32
-      ports:
-        - port: 2049
-          protocol: TCP
-        - port: 2049
-          protocol: UDP
-        - port: 111
-          protocol: TCP
-        - port: 111
-          protocol: UDP
-    - to:
-        - ipBlock:
-            cidr: 10.0.58.3/32
-      ports:
-        - port: 445
-          protocol: TCP
-    - to: []
-      ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-    - to:
-        - ipBlock:
-            cidr: 10.0.56.200/32
-        - ipBlock:
-            cidr: 10.43.33.87/32
         - namespaceSelector:
             matchLabels:
-              kubernetes.io/metadata.name: traefik-system
+              kubernetes.io/metadata.name: kube-system
           podSelector:
             matchLabels:
-              app.kubernetes.io/name: traefik
+              k8s-app: kube-dns
       ports:
-        - port: 80
-          protocol: TCP
-        - port: 443
-          protocol: TCP
-        - port: 8000
-          protocol: TCP
-        - port: 8443
+        - port: 53
+          protocol: UDP
+        - port: 53
           protocol: TCP
+    # Browser Lab home / internal docs target. Use the real service port
+    # directly rather than public Traefik host aliases.
     - to:
         - namespaceSelector:
             matchLabels:
@@ -120,6 +94,17 @@ spec:
       ports:
         - port: 5300
           protocol: TCP
+    # noc1 step-ca ACME endpoint. The lane brief called out 9000/TCP; the live
+    # ACME directory currently answers on 9443/TCP, so both stay pinned to the
+    # same host rather than reopening Traefik or internet egress.
+    - to:
+        - ipBlock:
+            cidr: 10.0.56.10/32
+      ports:
+        - port: 9000
+          protocol: TCP
+        - port: 9443
+          protocol: TCP
 ---
 # 2) fc-desktop-default-deny — namespace-wide catch-all.
 #
@@ -330,3 +315,11 @@ spec:
           protocol: UDP
         - port: 53
           protocol: TCP
+    - to:
+        - ipBlock:
+            cidr: 10.0.56.10/32
+      ports:
+        - port: 9000
+          protocol: TCP
+        - port: 9443
+          protocol: TCP