dc4245361d
RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding was adopted upstream and its canonical form is the provider: block in tenancy.yaml; adaptive-pricing declined the standing co-signature and supplied typed tier minima instead, recorded in ADR-0002. Three corrections against our own output are recorded in the documents rather than edited away. RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as overflow, enforced by make apps-pg-verify-capacity). T01/T02 are repository-complete: backup target, retention, per-consumer connection limits, role timeouts and Burstable resources are declared in source and published in s3-consumer-interfaces 1.1.0 before rollout. They stay in progress because no live application, backup success or restore proof exists, and declared configuration is not a section 13 artifact. T04 waits on that window. apps-pg R reason corrected to say the target is declared-not-applied rather than absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
82 lines
2.1 KiB
YAML
82 lines
2.1 KiB
YAML
# NetworkPolicies for the shared apps-pg cnpg cluster (RAILIANCE-WP-0003).
|
|
# The databases namespace has a default-deny-all policy; each cluster
|
|
# needs explicit egress-to-kube-api, ingress-from-cnpg-operator, and
|
|
# ingress-from-app-namespace policies.
|
|
#
|
|
# Unlike gitea-db (which hard-codes `default` as the consumer ns), this
|
|
# triplet uses a label-based opt-in: any namespace carrying the label
|
|
# `railiance.io/postgres-client=apps-pg` may connect on TCP/5432. The
|
|
# shared cluster cannot know its consumer namespaces in advance, so it
|
|
# expects each consumer to add this label as part of its onboarding.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-kube-api-apps-pg
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: apps-pg
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
- port: 6443
|
|
protocol: TCP
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-from-cnpg-operator-apps-pg
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: apps-pg
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cnpg-system
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
- port: 8000
|
|
protocol: TCP
|
|
- port: 9187
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-from-app-namespaces-apps-pg
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: apps-pg
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
railiance.io/postgres-client: apps-pg
|
|
podSelector: {}
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|