dc4245361d
RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding was adopted upstream and its canonical form is the provider: block in tenancy.yaml; adaptive-pricing declined the standing co-signature and supplied typed tier minima instead, recorded in ADR-0002. Three corrections against our own output are recorded in the documents rather than edited away. RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as overflow, enforced by make apps-pg-verify-capacity). T01/T02 are repository-complete: backup target, retention, per-consumer connection limits, role timeouts and Burstable resources are declared in source and published in s3-consumer-interfaces 1.1.0 before rollout. They stay in progress because no live application, backup success or restore proof exists, and declared configuration is not a section 13 artifact. T04 waits on that window. apps-pg R reason corrected to say the target is declared-not-applied rather than absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
54 lines
1.4 KiB
YAML
54 lines
1.4 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-kube-api-apps-pg-2
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {cnpg.io/cluster: apps-pg-2}
|
|
policyTypes: [Egress]
|
|
egress:
|
|
- ports:
|
|
- {port: 443, protocol: TCP}
|
|
- {port: 6443, protocol: TCP}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels: {kubernetes.io/metadata.name: kube-system}
|
|
ports:
|
|
- {port: 53, protocol: UDP}
|
|
- {port: 53, protocol: TCP}
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-from-cnpg-operator-apps-pg-2
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {cnpg.io/cluster: apps-pg-2}
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels: {kubernetes.io/metadata.name: cnpg-system}
|
|
ports:
|
|
- {port: 5432, protocol: TCP}
|
|
- {port: 8000, protocol: TCP}
|
|
- {port: 9187, protocol: TCP}
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-from-app-namespaces-apps-pg-2
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels: {cnpg.io/cluster: apps-pg-2}
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels: {railiance.io/postgres-client: apps-pg-2}
|
|
podSelector: {}
|
|
ports:
|
|
- {port: 5432, protocol: TCP}
|