Tighten RemoteDesktop network policies

apps/guacamole/guacamole.yaml

@@ -254,6 +254,68 @@ spec:
       targetPort: 4822
       name: guacd
 ---
+# Guacd display egress isolation.
+#
+# Guacamole web talks to guacd on TCP/4822. Guacd then opens the desktop
+# display connection to the per-session pod. Keep that second hop at raw VNC
+# 5901/TCP for the current RemoteDesktop Browser Lab/openSUSE images. Do not
+# grant guacd broad fc-desktop namespace egress; desktop-to-desktop lateral
+# paths remain blocked by apps/fc-desktop/network-policies.yaml.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: guacd-desktop-egress
+  namespace: guacamole
+  labels:
+    app.kubernetes.io/part-of: remotedesktop
+    app.kubernetes.io/component: display-isolation
+spec:
+  podSelector:
+    matchLabels:
+      app: guacd
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: guacamole
+      ports:
+        - port: 4822
+          protocol: TCP
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # kubectl-proxy sidecar reaches the Kubernetes API; keep it explicit
+    # because this NetworkPolicy selects the whole guacd pod.
+    - to: []
+      ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-desktop
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: remote-desktop
+      ports:
+        - port: 5901
+          protocol: TCP
+---
 # Guacamole Web Application
 apiVersion: apps/v1
 kind: Deployment