generated from coulomb/repo-seed
tegwick
ee794a61ab
namespaces/namespaces.yaml:
- sso, mfa, databases with net-kingdom/component labels for NetworkPolicy selectors
network-policies/{netpol-sso,netpol-mfa,netpol-databases}.yaml:
- Default-deny-all posture on all three namespaces
- sso: ingress from Traefik; egress to databases:5432 and mfa:8080
- mfa: ingress from Traefik + Keycloak; egress to databases:5432
- databases: ingress from sso/mfa + CNPG operator; egress to kube-dns + K8s API
- DNS (kube-system:53) allowed for all pods in all namespaces
cert-manager/issuers.yaml:
- selfsigned-issuer (ClusterIssuer) for internal/test use
- letsencrypt-prod (ClusterIssuer, HTTP-01/Traefik) — fill ACME_EMAIL before apply
cert-manager/test-certificate.yaml:
- 24h self-signed cert to smoke-test cert-manager
storage/verify-pvc.yaml:
- Test PVC + Pod to confirm default StorageClass provisioning
verify-t02.sh:
- Full verification script: namespaces, NetworkPolicies, issuers, certs, StorageClass
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
25 lines
533 B
YAML
25 lines
533 B
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: sso
|
|
labels:
|
|
# net-kingdom component label — used in NetworkPolicy namespaceSelector
|
|
net-kingdom/component: sso
|
|
app.kubernetes.io/part-of: net-kingdom-sso-mfa
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: mfa
|
|
labels:
|
|
net-kingdom/component: mfa
|
|
app.kubernetes.io/part-of: net-kingdom-sso-mfa
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: databases
|
|
labels:
|
|
net-kingdom/component: databases
|
|
app.kubernetes.io/part-of: net-kingdom-sso-mfa
|