From 4a8448b3b090a34bf475f6e33ed6962ac1e72d8c Mon Sep 17 00:00:00 2001
From: Micah Nagel <micah.nagel@defenseunicorns.com>
Date: Wed, 9 Oct 2024 11:10:16 -0600
Subject: [PATCH] fix: handle anywhere network target ip limitations for cilium

---
 src/keycloak/chart/templates/uds-package.yaml             | 5 ++---
 src/pepr/operator/controllers/network/generate.ts         | 4 ++--
 .../operator/controllers/network/generators/anywhere.ts   | 8 ++++++++
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/keycloak/chart/templates/uds-package.yaml b/src/keycloak/chart/templates/uds-package.yaml
index 2c1c52e47..1a73f846b 100644
--- a/src/keycloak/chart/templates/uds-package.yaml
+++ b/src/keycloak/chart/templates/uds-package.yaml
@@ -25,13 +25,12 @@ spec:
           app: pepr-uds-core-watcher
         port: 8080
 
-      # Temp workaround for any cluster pod
-      # todo: remove this once cluster pods is a remote generated target
       - description: "Keycloak backchannel access"
         direction: Ingress
         selector:
           app.kubernetes.io/name: keycloak
-        remoteGenerated: Anywhere
+        # Allow access from anything in cluster using an empty namespace selector
+        remoteNamespace: "*"
         port: 8080
 
       # Keycloak OCSP to check certs cannot guarantee a static IP
diff --git a/src/pepr/operator/controllers/network/generate.ts b/src/pepr/operator/controllers/network/generate.ts
index ecba6d1cb..ce654fc7a 100644
--- a/src/pepr/operator/controllers/network/generate.ts
+++ b/src/pepr/operator/controllers/network/generate.ts
@@ -2,7 +2,7 @@ import { V1NetworkPolicyPeer, V1NetworkPolicyPort } from "@kubernetes/client-nod
 import { kind } from "pepr";
 
 import { Allow, RemoteGenerated } from "../../crd";
-import { anywhere } from "./generators/anywhere";
+import { anywhere, anywhereInCluster } from "./generators/anywhere";
 import { cloudMetadata } from "./generators/cloudMetadata";
 import { intraNamespace } from "./generators/intraNamespace";
 import { kubeAPI } from "./generators/kubeAPI";
@@ -30,7 +30,7 @@ function getPeers(policy: Allow): V1NetworkPolicyPeer[] {
         break;
 
       case RemoteGenerated.Anywhere:
-        peers = [anywhere];
+        peers = [anywhere, anywhereInCluster];
         break;
     }
   } else if (policy.remoteNamespace !== undefined || policy.remoteSelector !== undefined) {
diff --git a/src/pepr/operator/controllers/network/generators/anywhere.ts b/src/pepr/operator/controllers/network/generators/anywhere.ts
index 58a982fc2..4caddb18e 100644
--- a/src/pepr/operator/controllers/network/generators/anywhere.ts
+++ b/src/pepr/operator/controllers/network/generators/anywhere.ts
@@ -8,3 +8,11 @@ export const anywhere: V1NetworkPolicyPeer = {
     except: [META_IP],
   },
 };
+
+/** Matches any endpoint in cluster
+ * This is primarily to support Cilium where IP based policies do not match/allow anything in-cluster
+ * Ref: https://github.com/defenseunicorns/uds-core/issues/871 and https://github.com/cilium/cilium/blob/v1.16.2/Documentation/network/kubernetes/policy.rst#networkpolicy
+ */
+export const anywhereInCluster: V1NetworkPolicyPeer = {
+  namespaceSelector: {},
+};