rock 8bd40c5152 feat: poimen-sandbox namespace + security hardening + RBAC ...

Phase 1: sandbox namespace with PSA restricted enforcement,
ResourceQuota (20 pods, 10/20 CPU, 20/40Gi memory), and
CiliumNetworkPolicy denying pi-session egress to kube-apiserver.

Phase 2: sandbox-observer Role + poimen-devs RoleBinding for
OIDC-authenticated kubectl access to sandbox pod status/logs.

2026-09-28 23:15:25 +08:00

..

cluster-maintenance

fix: aggressive 2m cleanup for completed jobs/pods, add PAPERLESS_USERNAME to paperless-ai

2026-09-14 07:56:05 +09:00

databases

feat(poimen): consolidate into single multi-source ArgoCD app

2026-09-28 08:51:31 +08:00

forgejo-runner

fix: use CiliumNetworkPolicy for kube-apiserver egress (#49)

2026-09-13 14:04:35 +00:00

iam

fix: authentik probe timeouts blocking DB migration on fresh cluster

2026-09-13 06:02:28 +09:00

logging

fix(grafana): re-enable org role sync for OAuth groups

2026-09-15 00:37:06 +09:00

longhorn

fix(longhorn): enable worker-1 scheduling, 400Gi reserved

2026-09-28 23:06:22 +08:00

minio

fix(minio): add BROWSER_REDIRECT_URL to enable SSO button in Console

2026-09-15 02:44:09 +09:00

monitoring

feat(cag): PrometheusRule + Grafana panels for KV cache observability

2026-09-27 18:37:03 +08:00

poimen

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

rbac

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

tekton

fix: vendor Tekton release.yaml for proper ArgoCD management

2026-09-13 15:10:39 +09:00

tracing

feat(cag): PrometheusRule + Grafana panels for KV cache observability

2026-09-27 18:37:03 +08:00