From 687e022e9fbb9b3ca04dc34e46c4b5555d405c1a Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 18 Jul 2026 20:57:27 +0200 Subject: [PATCH] fix(netpol): allow woodpecker secret-rotator to reach OpenBao MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The woodpecker-secret-rotate CronJob (#297) runs in ns apps and could not reach OpenBao (i/o timeout on auth/kubernetes/login) — blocked on BOTH sides: apps is egress-default-deny (no openbao allow) and openbao is ingress-default-deny (rotator not allowlisted). The snapshot job avoids this by living in the openbao ns; ESO is explicitly allowlisted. - default-deny.yaml (apps egress): namespace-wide allow to openbao:8200, scoped in effect by openbao's ingress (mosquitto pattern). - openbao-ns.yaml (openbao ingress): scoped allow from the rotator pod labels (apps/woodpecker/secret-rotator) — the real security boundary. Verified apps has no other blocking egress; kustomize build + yamllint clean. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ --- .../network-policies/default-deny.yaml | 11 +++++++++++ .../infrastructure/network-policies/openbao-ns.yaml | 12 ++++++++++++ 2 files changed, 23 insertions(+) diff --git a/kubernetes/infrastructure/network-policies/default-deny.yaml b/kubernetes/infrastructure/network-policies/default-deny.yaml index b47ff68c..c59c2942 100644 --- a/kubernetes/infrastructure/network-policies/default-deny.yaml +++ b/kubernetes/infrastructure/network-policies/default-deny.yaml @@ -45,6 +45,17 @@ spec: - ports: - port: "1883" protocol: TCP + # woodpecker-secret-rotate CronJob writes WOODPECKER_AGENT_SECRET to the + # OpenBao KV API (:8200). Namespace-wide egress here is scoped in effect by + # openbao's own ingress policy (rotator pod only) — same pattern as the + # mosquitto rule above (see openbao-ns.yaml). + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": openbao + toPorts: + - ports: + - port: "8200" + protocol: TCP - toEntities: - host - remote-node diff --git a/kubernetes/infrastructure/network-policies/openbao-ns.yaml b/kubernetes/infrastructure/network-policies/openbao-ns.yaml index 222cad4e..430a162f 100644 --- a/kubernetes/infrastructure/network-policies/openbao-ns.yaml +++ b/kubernetes/infrastructure/network-policies/openbao-ns.yaml @@ -31,6 +31,18 @@ spec: - ports: - port: "8200" protocol: TCP + # woodpecker-secret-rotate CronJob (apps ns) writes WOODPECKER_AGENT_SECRET + # via the KV API. Scoped to the rotator pod labels — this ingress rule is the + # actual security boundary for the namespace-wide apps->openbao egress allow. + - fromEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": apps + app.kubernetes.io/name: woodpecker + app.kubernetes.io/component: secret-rotator + toPorts: + - ports: + - port: "8200" + protocol: TCP egress: # Adding an egress stanza flips this namespace from egress-unrestricted to # egress default-deny. The intent is to block lateral in-cluster egress — -- 2.54.0