mirror of
https://github.com/hanzoai/vault.git
synced 2026-10-30 18:18:35 +00:00
zeekay
cda584c628
- Multi-stage Alpine Dockerfile with non-root user and healthcheck - K8s: namespace (hanzo-vault, PCI zone 3), deployment (Recreate, read-only rootfs, security hardening), service, NetworkPolicies (deny-all default, allow commerce on 8443, allow DNS) - ServiceAccount for RBAC - GitHub Actions: test, build (multi-arch GHCR), Trivy scan, deploy
53 lines
944 B
YAML
53 lines
944 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: vault-deny-all
|
|
namespace: hanzo-vault
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress: []
|
|
egress: []
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: vault-allow-commerce
|
|
namespace: hanzo-vault
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: vault-service
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: hanzo
|
|
podSelector:
|
|
matchLabels:
|
|
app: commerce
|
|
ports:
|
|
- port: 8443
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: vault-allow-dns
|
|
namespace: hanzo-vault
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to: []
|
|
ports:
|
|
- port: 53
|
|
protocol: UDP
|
|
- port: 53
|
|
protocol: TCP
|