From 36d82bcf2d5ba731615f48c7142e128daa84d023 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Tue, 11 Aug 2026 21:42:25 -0300
Subject: [PATCH] hermes: allow Switchyard Vault bootstrap

---
 services/hermes/networkpolicy.yaml     |  9 +++++++++
 testing/tests/test_hermes_cli_lanes.py | 27 ++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/services/hermes/networkpolicy.yaml b/services/hermes/networkpolicy.yaml
index 094b92365..ce5402919 100644
--- a/services/hermes/networkpolicy.yaml
+++ b/services/hermes/networkpolicy.yaml
@@ -326,6 +326,15 @@ spec:
       ports:
         - {protocol: UDP, port: 53}
         - {protocol: TCP, port: 53}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - {protocol: TCP, port: 8200}
     - to:
         - namespaceSelector:
             matchLabels:
diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py
index 18e0d6a32..78bfe33ec 100644
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@@ -872,6 +872,33 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog():
     ]
 
 
+def test_switchyard_network_boundary_allows_vault_bootstrap():
+    """The pre-populate init container must reach Vault before routing starts."""
+    documents = [
+        item
+        for item in yaml.safe_load_all((HERMES / "networkpolicy.yaml").read_text())
+        if item
+    ]
+    isolation = next(
+        item
+        for item in documents
+        if item.get("metadata", {}).get("name") == "hermes-switchyard-isolation"
+    )
+    assert any(
+        rule.get("to")
+        == [
+            {
+                "namespaceSelector": {
+                    "matchLabels": {"kubernetes.io/metadata.name": "vault"}
+                },
+                "podSelector": {"matchLabels": {"app": "vault"}},
+            }
+        ]
+        and rule.get("ports") == [{"protocol": "TCP", "port": 8200}]
+        for rule in isolation["spec"]["egress"]
+    )
+
+
 def test_owner_agent_installs_the_pinned_operator_toolchain():
     script = (SCRIPTS / "install_agent_tools.sh").read_text()
     for value in [