7a55b259bf
Three fenced worker Pods claim Hermes Kanban runs through a coordinator that owns every state transition, with per-ordinal HMAC authority, a mediated broker-only SCM path, and durable per-ordinal workspaces. Content is the reviewed head of PR #18 (689bcb6e) with PR 16's and PR 19's contributions removed: they were merged in only to validate co-existence and are not prerequisites, so this branch no longer carries them as ancestors. Only PR 14 and PR 15 remain, because the broker boundary and the cli_lane_* decomposition are load-bearing for two of the fixed P0 boundaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
1.3 KiB
YAML
53 lines
1.3 KiB
YAML
# services/hermes-scm-broker/networkpolicy.yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: hermes-scm-broker-isolation
|
|
namespace: hermes-scm
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-scm-broker
|
|
policyTypes: [Ingress, Egress]
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: hermes
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-agent
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: hermes
|
|
podSelector:
|
|
matchLabels:
|
|
app: hermes-execution-mediator
|
|
ports:
|
|
- {protocol: TCP, port: 9081}
|
|
egress:
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- {protocol: UDP, port: 53}
|
|
- {protocol: TCP, port: 53}
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: vault
|
|
podSelector:
|
|
matchLabels:
|
|
app: vault
|
|
ports:
|
|
- {protocol: TCP, port: 8200}
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 192.168.22.9/32
|
|
ports:
|
|
- {protocol: TCP, port: 443}
|