Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

helm/vergabe-demo-company-foundation.yaml

@@ -0,0 +1,94 @@
+# RAPPS-WP-0014: admitted empty demo workspace; no credentials or database data.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vergabe-demo-company
+  labels:
+    railiance.io/workload-class: application
+    railiance.io/postgres-client: apps-pg
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: vergabe-demo-company
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vergabe-runtime
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vergabe-teilnahme
+      app.kubernetes.io/instance: vergabe-teilnahme
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8000
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: apps-pg
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-acme-http01
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: 'true'
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8089
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vergabe-demo-tls
+  namespace: vergabe-demo-company
+spec:
+  secretName: vergabe-demo-tls
+  dnsNames:
+  - vergabe-teilnahme.coulomb.social
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod