rock 8bd40c5152 feat: poimen-sandbox namespace + security hardening + RBAC ...

Phase 1: sandbox namespace with PSA restricted enforcement,
ResourceQuota (20 pods, 10/20 CPU, 20/40Gi memory), and
CiliumNetworkPolicy denying pi-session egress to kube-apiserver.

Phase 2: sandbox-observer Role + poimen-devs RoleBinding for
OIDC-authenticated kubectl access to sandbox pod status/logs.

2026-09-28 23:15:25 +08:00

..

kustomization.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

memory-db.yaml

feat(poimen): consolidate into single multi-source ArgoCD app

2026-09-28 08:51:31 +08:00

pi-session-netpol.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

poimen-sandbox-namespace.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00

poimen-sandbox-quota.yaml

feat: poimen-sandbox namespace + security hardening + RBAC

2026-09-28 23:15:25 +08:00