Zero Trust Architecture

package zerotrust.access

import rego.v1

default allow := false

# Require ALL conditions for access (never trust, always verify)
allow if {
    identity_verified
    device_compliant
    context_acceptable
    permission_granted
}

# Identity must be authenticated with MFA
identity_verified if {
    input.identity.authenticated == true
    input.identity.mfa_verified == true
    time.now_ns() < input.identity.token_expiry_ns
}

# Device must meet compliance baseline
device_compliant if {
    input.device.managed == true
    input.device.os_patched == true
    input.device.encryption_enabled == true
    input.device.edr_running == true
    input.device.risk_score < 50
}

# Context checks: location, time, behavior
context_acceptable if {
    not input.context.impossible_travel
    input.context.risk_score < 70
}

# RBAC + resource-level check
permission_granted if {
    required_role := data.resource_roles[input.resource.path][input.method]
    required_role == input.identity.roles[_]
}

# Zero Trust micro-segmentation: default deny ALL traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# A connection must be allowed at BOTH ends. This is the caller's egress —
# without it api-gateway's default-deny egress drops the request.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-egress-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-gateway
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: backend-service
    ports:
    - port: 8080
      protocol: TCP

---
# The receiver's ingress: allow api-gateway -> backend on port 8080 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-service
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-gateway
    ports:
    - port: 8080
      protocol: TCP

---
# The caller's egress: backend -> postgres on port 5432
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-egress-postgres
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - port: 5432
      protocol: TCP

---
# The receiver's ingress: allow backend -> postgres on port 5432 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-postgres
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: postgres
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend-service
    ports:
    - port: 5432
      protocol: TCP

---
# DNS egress to CoreDNS in kube-system — default-deny blocks :53, and scoping
# to kube-system avoids allowing DNS to any host on port 53.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

# Cloudflare Access — ZTNA for internal apps (no VPN needed)
# Provider v5 names; account-scoped resources and object-based conditions.
terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.19"
    }
  }
}

provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

variable "cloudflare_account_id" { type = string }
variable "cloudflare_api_token" {
  type      = string
  sensitive = true
}

resource "cloudflare_zero_trust_access_policy" "allow_employees" {
  account_id       = var.cloudflare_account_id
  name             = "Allow employees"
  decision         = "allow"
  session_duration = "24h"
  include = [
    { email_domain = { domain = "example.com" } }
  ]
}

resource "cloudflare_zero_trust_access_policy" "allow_service_token" {
  account_id = var.cloudflare_account_id
  name       = "Allow CI service token"
  decision   = "non_identity"
  include = [
    { service_token = { token_id = cloudflare_zero_trust_access_service_token.ci.id } }
  ]
}

resource "cloudflare_zero_trust_access_service_token" "ci" {
  account_id = var.cloudflare_account_id
  name       = "CI/CD token"
  duration   = "8760h"
}

resource "cloudflare_zero_trust_access_application" "internal_wiki" {
  account_id       = var.cloudflare_account_id
  name             = "Internal Wiki"
  domain           = "wiki.internal.example.com"
  type             = "self_hosted"
  session_duration = "24h"
  policies = [
    {
      id         = cloudflare_zero_trust_access_policy.allow_employees.id
      precedence = 1
    },
    {
      id         = cloudflare_zero_trust_access_policy.allow_service_token.id
      precedence = 2
    },
  ]
}