hermes: allow Switchyard Vault bootstrap

services/hermes/networkpolicy.yaml

@@ -326,6 +326,15 @@ spec:
       ports:
         - {protocol: UDP, port: 53}
         - {protocol: TCP, port: 53}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - {protocol: TCP, port: 8200}
     - to:
         - namespaceSelector:
             matchLabels:

testing/tests/test_hermes_cli_lanes.py

@@ -872,6 +872,33 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog():
     ]
 
 
+def test_switchyard_network_boundary_allows_vault_bootstrap():
+    """The pre-populate init container must reach Vault before routing starts."""
+    documents = [
+        item
+        for item in yaml.safe_load_all((HERMES / "networkpolicy.yaml").read_text())
+        if item
+    ]
+    isolation = next(
+        item
+        for item in documents
+        if item.get("metadata", {}).get("name") == "hermes-switchyard-isolation"
+    )
+    assert any(
+        rule.get("to")
+        == [
+            {
+                "namespaceSelector": {
+                    "matchLabels": {"kubernetes.io/metadata.name": "vault"}
+                },
+                "podSelector": {"matchLabels": {"app": "vault"}},
+            }
+        ]
+        and rule.get("ports") == [{"protocol": "TCP", "port": 8200}]
+        for rule in isolation["spec"]["egress"]
+    )
+
+
 def test_owner_agent_installs_the_pinned_operator_toolchain():
     script = (SCRIPTS / "install_agent_tools.sh").read_text()
     for value in [