Random flows DROPPED targetting service using GAMMA HTTPRoutes #41970

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: third-party-api-internal
  namespace: preprod
spec:
  parentRefs:
    # gamma route
    - group: ""
      kind: Service
      name: third-party-api
      port: 80
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: permission-api
          port: 80
          weight: 1
      filters:
        - requestHeaderModifier:
            set:
              - name: x-forwarded-prefix
                value: /some-route
          type: RequestHeaderModifier
        - type: URLRewrite
          urlRewrite:
            path:
              replacePrefixMatch: /some-route
              type: ReplacePrefixMatch
      matches:
        - path:
            type: PathPrefix
            value: /some-route
    # catch all rules
    - backendRefs:
        - group: ""
          kind: Service
          name: third-party-api
          port: 80
          weight: 1
      filters:
        - requestHeaderModifier:
            set:
              - name: x-forwarded-prefix
                value: /third-party
          type: RequestHeaderModifier
      matches:
        - path:
            type: PathPrefix
            value: /

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-third-party-api
  namespace: brc-preprod
spec:
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/instance: backoffice-bff
          app.kubernetes.io/name: backoffice-bff
    ports:
    - port: 8080
      protocol: TCP
	# a few other from rules...
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: third-party-api
      app.kubernetes.io/name: third-party-api
  policyTypes:
  - Ingress

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-cilium-ingress-entity-to-third-party-api
  namespace: brc-preprod
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/instance: third-party-api
  ingress:
  - fromEntities:
    - ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-metadata-access
  namespace: brc-preprod
spec:
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
  - to:
    - namespaceSelector: {}
  podSelector: {}
  policyTypes:
  - Egress

apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: allow-all-to-ingress-entity
spec:
  description: "Allow all the ingress+egress traffic from reserved ingress identity to any endpoints in the cluster"
  endpointSelector:
    matchExpressions:
    - key: reserved:ingress
      operator: Exists
  egress:
  - toEntities:
    - cluster
  ingress:
  - fromEntities:
    - all

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-all-traffic
  namespace: brc-preprod
spec:
  description: "allow all egress to ingress and services"
  egress:
  - toEntities:
    - ingress
  - toCIDR:
    - 10.100.0.0/16
  endpointSelector: {}

cilium:
  # Enable "native" routing mode to let the Node take care of the routing part
  routingMode: native

  eni:
    enabled: true
    awsReleaseExcessIPs: true
    # restrict Cilium to use only subnets dedicated to the cluster
    subnetTagsFilter:
      - karpenter.sh/discovery=PPRD_aws_eks_cluster

  ipam:
    mode: eni

  cni:
    exclusive: true

  # Enable Wireguard transparent encryption
  encryption:
    enabled: true
    type: wireguard

  # Enable egress masquerade only for Node interfaces (not Pods)
  egressMasqueradeInterfaces: eth+
  enableIPv4Masquerade: true

  # Rollout Cilium Pods on config updates
  rollOutCiliumPods: true

  # Enable matching of node IPs in NetworkPolicies
  # ⚠️ This is required by SNAT netpols for istio to work
  policyCIDRMatchMode: nodes

  prometheus:
    enabled: true

  operator:
    rollOutPods: true
    tolerations:
      - operator: Exists
    unmanagedPodWatcher:
      restart: false

  # Enable Hubble
  hubble:
    # Redact L7 information (headers, querys, etc.) for security
    redact:
      enabled: true
    relay:
      enabled: true
      rollOutPods: true

    ui:
      enabled: true
      rollOutPods: true

    export:
      # Configure Hubble events export
      static:
        enabled: true
        fileCompress: true
        filePath: /var/run/cilium/hubble/events.log
        allowList:
          # Filter Hubble events to only keep DENIED or AUDITED network flows
          - '{"verdict":["DROPPED","AUDIT"],"protocol":["udp","tcp"],"ip_version":["IPv4"]}'
        denyList:
          # Remove flows to the metadata server that are blocked on purpose
          - '{"destination_ip":["169.254.169.254"]}'

  ## Gateway API Features ------------------------------------------------------

  # Control L7 traffic via CRDs (e.g. CiliumNetworkPolicies)
  # Deploys a DaemonSet of cilium-envoy
  l7Proxy: true

  # We need NodePort Service for making Gateway API working
  # Can be disabled once Cilium replaces kube-proxy
  nodePort:
    enabled: true

  # Enable Gateway API Controller
  gatewayAPI:
    enabled: true

  envoy:
    rollOutPods: true