Skip to content

0017. Tightening CNPs for Authentik + open-webui

  • Status: accepted
  • Date: 2026-05-28
  • Deciders: lusoris
  • Related: PR #446

Context

Five workloads deferred from the preceding network-policy change lacked per-workload Cilium policy declarations: Authentik server, worker, two proxy outposts, and Open WebUI. PR #446 based the required flows on a 30-minute Hubble capture, pod TCP state, and verified workload labels.

Decision

Add workload-specific CiliumNetworkPolicy resources for Authentik server, Authentik worker, the home and office Authentik proxy outposts, and Open WebUI while retaining the permissive namespace baseline.

Alternatives considered

Replace the permissive namespace baseline with default-deny immediately; deferred until per-workload coverage could be proven from in-flight traffic.

Consequences

cluster/network-policies/cnp-authentik.yaml and cnp-ai-open-webui.yaml now declare the observed ingress and egress intent for all five workloads. Because Cilium combines these policies with the retained permissive baseline, the shipped change documents those flows without making the namespaces default-deny.

References

  • PR #446 — feat(network-policies): tighten CNPs for Authentik + open-webui