# dmitriy-zhuravel/cilium-strict-policies architecture

> Architecture diagram of the GitHub repository dmitriy-zhuravel/cilium-strict-policies, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dmitriy-zhuravel/cilium-strict-policies
- Repository: https://github.com/dmitriy-zhuravel/cilium-strict-policies

## Overview

This repository is a declarative Cilium policy collection, not an application runtime. An operator applies the cluster and host policy manifests; Cilium enforces the resulting traffic rules. The README documents the main policy responsibilities, but no YAML excerpts were available to verify additional selectors or individual rule wiring.

Main entry points: [`cluster-policies/etcd.yaml`](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/etcd.yaml) (etcd traffic), [`cluster-policies/vxlan.yaml`](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/vxlan.yaml) (VXLAN traffic), [`cluster-policies/icmp.yaml`](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/icmp.yaml) (ICMP probes), [`cluster-policies/kube-api.yaml`](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/kube-api.yaml) (API and kubelet)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cluster["Cluster policies"]
  node_cluster_set["Cluster policy set"]
  node_etcd["etcd traffic<br/>[etcd.yaml]"]
  node_vxlan["VXLAN traffic<br/>[vxlan.yaml]"]
  node_icmp["ICMP probes<br/>[icmp.yaml]"]
  node_kube_api["API and kubelet<br/>[kube-api.yaml]"]
  node_hubble["Hubble traffic<br/>[hubble.yaml]"]
  node_health["Cilium health<br/>[health.yaml]"]
  node_coredns["CoreDNS traffic<br/>[coredns.yaml]"]
end

subgraph group_host["Host policies"]
  node_host_set["Host policy set"]
  node_ssh["SSH access<br/>[ssh.yaml]"]
  node_ntp["NTP sync<br/>[ntp.yaml]"]
  node_dns["Host DNS<br/>[dns.yaml]"]
  node_updates["Package updates<br/>[updates.yaml]"]
end

node_operator(("Cluster operator"))
node_cilium["Cilium enforcement"]

node_operator -->|"applies"| node_cluster_set
node_operator -->|"applies"| node_host_set
node_etcd -->|"governs traffic"| node_cilium
node_vxlan -->|"governs traffic"| node_cilium
node_icmp -->|"governs traffic"| node_cilium
node_kube_api -->|"governs traffic"| node_cilium
node_hubble -->|"governs traffic"| node_cilium
node_health -->|"governs traffic"| node_cilium
node_coredns -->|"governs traffic"| node_cilium
node_ssh -->|"governs traffic"| node_cilium
node_ntp -->|"governs traffic"| node_cilium
node_dns -->|"governs traffic"| node_cilium
node_updates -->|"governs traffic"| node_cilium

click node_cluster_set "https://github.com/dmitriy-zhuravel/cilium-strict-policies/tree/main/cluster-policies"
click node_etcd "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/etcd.yaml"
click node_vxlan "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/vxlan.yaml"
click node_icmp "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/icmp.yaml"
click node_kube_api "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/kube-api.yaml"
click node_hubble "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/hubble.yaml"
click node_health "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/health.yaml"
click node_coredns "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/coredns.yaml"
click node_host_set "https://github.com/dmitriy-zhuravel/cilium-strict-policies/tree/main/host-policies"
click node_ssh "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/ssh.yaml"
click node_ntp "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/ntp.yaml"
click node_dns "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/dns.yaml"
click node_updates "https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/updates.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cluster_set,node_etcd,node_vxlan,node_icmp,node_kube_api,node_hubble,node_health,node_coredns toneBlue
class node_host_set,node_ssh,node_ntp,node_dns,node_updates toneAmber
class node_operator,node_cilium toneIndigo
```

## Components

### Cluster policies

- [Cluster policy set](https://github.com/dmitriy-zhuravel/cilium-strict-policies/tree/main/cluster-policies): `cluster-policies`
- [etcd traffic](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/etcd.yaml): `cluster-policies/etcd.yaml`
- [VXLAN traffic](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/vxlan.yaml): `cluster-policies/vxlan.yaml`
- [ICMP probes](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/icmp.yaml): `cluster-policies/icmp.yaml`
- [API and kubelet](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/kube-api.yaml): `cluster-policies/kube-api.yaml`
- [Hubble traffic](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/hubble.yaml): `cluster-policies/hubble.yaml`
- [Cilium health](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/health.yaml): `cluster-policies/health.yaml`
- [CoreDNS traffic](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/cluster-policies/coredns.yaml): `cluster-policies/coredns.yaml`

### Host policies

- [Host policy set](https://github.com/dmitriy-zhuravel/cilium-strict-policies/tree/main/host-policies): `host-policies`
- [SSH access](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/ssh.yaml): `host-policies/ssh.yaml`
- [NTP sync](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/ntp.yaml): `host-policies/ntp.yaml`
- [Host DNS](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/dns.yaml): `host-policies/dns.yaml`
- [Package updates](https://github.com/dmitriy-zhuravel/cilium-strict-policies/blob/main/host-policies/updates.yaml): `host-policies/updates.yaml`

### Other components

- **Cluster operator**
- **Cilium enforcement**

## Connections

- Cluster operator → Cluster policy set: applies
- Cluster operator → Host policy set: applies
- etcd traffic → Cilium enforcement: governs traffic
- VXLAN traffic → Cilium enforcement: governs traffic
- ICMP probes → Cilium enforcement: governs traffic
- API and kubelet → Cilium enforcement: governs traffic
- Hubble traffic → Cilium enforcement: governs traffic
- Cilium health → Cilium enforcement: governs traffic
- CoreDNS traffic → Cilium enforcement: governs traffic
- SSH access → Cilium enforcement: governs traffic
- NTP sync → Cilium enforcement: governs traffic
- Host DNS → Cilium enforcement: governs traffic
- Package updates → Cilium enforcement: governs traffic