deploy atlas probe

[fmurodov]

No description provided.

[claude]

Code Review - Issues Found

I found 2 high-signal issues in this PR that need attention:

---

Issue 1: Missing Parent Kustomization Reference (kubernetes/apps/talos1018/kustomization.yaml)

Problem: The new guest directory is not referenced in the parent kustomization file at kubernetes/apps/talos1018/kustomization.yaml. This means Flux will not discover or deploy any of the resources in this directory.

Impact: The entire deployment added by this PR (namespace, network policies, RIPE Atlas probe) will not be applied to the cluster.

Current state: The parent kustomization.yaml references other category directories like ./network, ./security, ./observability, but ./guest is missing from the resources list.

Fix: Add - ./guest to the resources list in kubernetes/apps/talos1018/kustomization.yaml:

---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ./kube-system

  # Network and Infrastructure
  - ./network

  - ./security

  # Guest Services
  - ./guest

  # Monitoring and Observability
  - ./observability
  
  # ... rest of file

Reference: CLAUDE.md lines 150-166 explicitly requires "Add to kubernetes/apps/talos1018/kustomization.yaml" when adding new applications.

---

Issue 2: Network Policy Deny Rules Override Allow Rules

Problem: The guest-default-deny CiliumNetworkPolicy uses egressDeny and ingressDeny fields, which in Cilium always take precedence over egress allow rules. This means the allow rules in guest-allow-internet will never take effect.

Files affected:

• network-policy-default.yaml lines 10-15
• network-policy-allow-internet.yaml lines 10-37

Impact: The RIPE Atlas probe will have no network connectivity at all (no DNS, no internet access), making it completely non-functional.

Root cause: In Cilium's policy model, deny policies always take precedence over allow policies. The egressDeny: toEntities: all rule blocks all egress traffic, and the egress allow rules in the second policy cannot override it.

Fix: Replace the explicit deny rules with an empty egress/ingress list to achieve default-deny semantics:

# network-policy-default.yaml
---
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: guest-default-deny
  namespace: guest
spec:
  endpointSelector: {}
  egress: []    # Empty list enables policy enforcement with default deny
  ingress: []   # Empty list enables policy enforcement with default deny

This establishes default-deny behavior (policy enforcement is active, but no traffic is allowed) without using unoverridable deny rules, allowing the guest-allow-internet policy's allow rules to work correctly.

---

Both issues should be addressed to ensure the RIPE Atlas probe deployment functions correctly.