api | web | docs: isolate teams on the network with admin exceptions - #29

Root cause

Unbind created no NetworkPolicies, so every pod could connect to every service in every team namespace. Team boundaries existed in RBAC and the UI but not on the network.

What changed

• Team isolation. Every team namespace gets unbind-team-isolation. It accepts ingress from its own namespace and from namespaces without the unbind.app/team-namespace label (unbind-system, kube-system and similar). Egress is not limited.
• Exceptions. System admins manage them under System > Settings > Network. An exception lets a service accept connections from either a service in another team or any source. Any source covers servers and hosts on the private network, such as the node callbacks to betsy. Exceptions are stored in network_exceptions and cascade when a service is deleted.
• Node ports. A NodePort service gets a policy that opens its ports to everyone, since the port is already public on every server.
• Sync. NetworkPolicyManager in the API applies everything at startup, after team create, after every settings change, and every minute. The minute sync follows node port changes and puts back policies edited by hand.
• Rollout. Isolation is on for new installs. The migration turns it off for existing installs, so admins can add exceptions first.
• RBAC. Team roles no longer include networkpolicies, so a team editor can't delete their own isolation.
• Docs and MCP. New docs page operations/network-isolation. The MCP instructions mention isolation.

No chart, CRD or operator changes. The API's service account can already manage NetworkPolicies and patch namespaces.

Banano

I mapped cross-team traffic on unbind-banano over MCP, read only. These exceptions are needed before turning isolation on:

• natricon (Appditto) to pippin-nano (Banano), port 11338
• betsy-nano (Banano) to natrium-server (Appditto), port 3001
• any source to betsy-banano and betsy-nano, for node callbacks from 10.0.32.10 and 10.0.64.3

Cilium's docs say CIDR rules don't match cluster nodes, so the node callbacks need the any-source exception. This isn't tested on Cilium yet.

Testing

• Unit tests:
  • policy generation
  • sync against a fake clientset: label, create, update, delete stale, isolation off
  • exception validation in the service
  • repository queries
• Dev cluster (k3s):
  • same team: allowed
  • other team: blocked
  • unbind-system and the node: allowed
  • exception: only the chosen source gets through
  • host to NodePort: blocked before sync, 200 after
  • turning isolation off: every managed policy removed
  • no updates between syncs when nothing changed

fixes UNB-384