1a6d83ace9
Founder decision 2026-10-21 (T05 follow-up): custodian-assessment gets default-deny ingress/egress with egress only to DNS, kube-apiserver (10.43.0.1:443, 92.205.62.239:6443), Prometheus 9090 and State Hub 8000. The railiance-platform-addons AppProject source admits PersistentVolumeClaim and NetworkPolicy (bootstrap is hand-applied; not applied here). CronJob gets STATE_HUB_URL. Re-vendored the-custodian sources at 9edd315. Still suspended and unregistered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 8340@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
28 lines
931 B
YAML
28 lines
931 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# CUST-WP-0071-T05. NOT referenced by any Application yet: the draft lives in
|
|
# argocd/railiance01/drafts/custodian-allocation-review.application.yaml.
|
|
# src/ is vendored from owner repos (the-custodian, railiance-cluster,
|
|
# resource-control); vendor.lock.json pins the source commits and sha256.
|
|
# Refresh with tools/vendor_custodian_allocation_review.py, never by hand.
|
|
|
|
namespace: custodian-assessment
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- rbac.yaml
|
|
- pvc.yaml
|
|
- networkpolicy.yaml
|
|
- cronjob.yaml
|
|
|
|
configMapGenerator:
|
|
- name: custodian-allocation-review-source
|
|
files:
|
|
- src/weekly_allocation_incluster.py
|
|
- src/weekly_allocation_report.py
|
|
- src/reconcile_railiance_allocation.py
|
|
- src/observe_cluster_resources.py
|
|
- src/weekly-allocation-queries.json
|
|
- src/namespace-ownership.json
|
|
- src/reef-railiance-k3s.json
|