52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
|
# NetworkPolicy for signing-service.
|
||
|
|
#
|
||
|
|
# Cluster-wide NetworkPolicy enforcement is already active on BasicStack
|
||
|
|
# (see cluster memory on NetworkPolicy activation). Any pod in agent-trust
|
||
|
|
# without a policy is isolated by default; this file is the explicit
|
||
|
|
# allow-list for signing-service.
|
||
|
|
#
|
||
|
|
# Ingress: anyone in agent-trust (admin-api, attest-reconciler, transparency-log)
|
||
|
|
# plus future callers reaching through an in-cluster ingress controller.
|
||
|
|
# Egress: DNS (kube-system/coredns), and later the OpenBao Transit namespace
|
||
|
|
# and Pocket ID (JWKS) when those backends are wired. For now the
|
||
|
|
# service only needs DNS egress — the memory backend and static
|
||
|
|
# validator are self-contained.
|
||
|
|
apiVersion: networking.k8s.io/v1
|
||
|
|
kind: NetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: signing-service
|
||
|
|
namespace: agent-trust
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: signing-service
|
||
|
|
app.kubernetes.io/part-of: proofedmesh
|
||
|
|
spec:
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: signing-service
|
||
|
|
policyTypes:
|
||
|
|
- Ingress
|
||
|
|
- Egress
|
||
|
|
ingress:
|
||
|
|
- from:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
name: agent-trust
|
||
|
|
ports:
|
||
|
|
- port: 8081
|
||
|
|
protocol: TCP
|
||
|
|
# Future: add admin-api / app namespaces here once they are deployed and
|
||
|
|
# labelled. Keep the list conservative — add on demand, not speculatively.
|
||
|
|
egress:
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: kube-system
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
k8s-app: kube-dns
|
||
|
|
ports:
|
||
|
|
- port: 53
|
||
|
|
protocol: UDP
|
||
|
|
- port: 53
|
||
|
|
protocol: TCP
|