1a6d83ace9
Founder decision 2026-10-21 (T05 follow-up): custodian-assessment gets default-deny ingress/egress with egress only to DNS, kube-apiserver (10.43.0.1:443, 92.205.62.239:6443), Prometheus 9090 and State Hub 8000. The railiance-platform-addons AppProject source admits PersistentVolumeClaim and NetworkPolicy (bootstrap is hand-applied; not applied here). CronJob gets STATE_HUB_URL. Re-vendored the-custodian sources at 9edd315. Still suspended and unregistered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 8340@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
# CUST-WP-0071-T05 (founder decision 2026-10-21): default-deny egress and no
|
|
# ingress for the custodian-assessment namespace. The job may reach only:
|
|
# DNS kube-system/kube-dns (CoreDNS) 53 UDP/TCP
|
|
# kube-apiserver 10.43.0.1:443 (the `kubernetes` Service) and its k3s
|
|
# endpoint 92.205.62.239:6443 (same pair as rapp-telemetry's
|
|
# telemetry-isolation, since k3s may match either side of DNAT)
|
|
# Prometheus telemetry/prometheus pods 9090
|
|
# State Hub API state-hub/state-hub pods 8000 (the Service listens on 8000)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: custodian-assessment-default-deny
|
|
namespace: custodian-assessment
|
|
labels:
|
|
app.kubernetes.io/name: custodian-allocation-review
|
|
app.kubernetes.io/part-of: railiance-platform
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes: [Ingress, Egress]
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: custodian-allocation-review-egress
|
|
namespace: custodian-assessment
|
|
labels:
|
|
app.kubernetes.io/name: custodian-allocation-review
|
|
app.kubernetes.io/part-of: railiance-platform
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: custodian-allocation-review
|
|
policyTypes: [Egress]
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- {protocol: UDP, port: 53}
|
|
- {protocol: TCP, port: 53}
|
|
- to:
|
|
- ipBlock: {cidr: 10.43.0.1/32}
|
|
ports:
|
|
- {protocol: TCP, port: 443}
|
|
- to:
|
|
- ipBlock: {cidr: 92.205.62.239/32}
|
|
ports:
|
|
- {protocol: TCP, port: 6443}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: telemetry
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: prometheus
|
|
ports:
|
|
- {protocol: TCP, port: 9090}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: state-hub
|
|
podSelector:
|
|
matchLabels:
|
|
app: state-hub
|
|
ports:
|
|
- {protocol: TCP, port: 8000}
|