homelab/k8s/infra/poimen/poimen-sandbox-namespace.yaml at f6207ff2b0f5c4e3dbf77f8ee4a1972a246936ac - homelab - Gitea: Git with a cup of tea

riotpiao-poimen/homelab

Files

T

rock 8bd40c5152 feat: poimen-sandbox namespace + security hardening + RBAC

Phase 1: sandbox namespace with PSA restricted enforcement,
ResourceQuota (20 pods, 10/20 CPU, 20/40Gi memory), and
CiliumNetworkPolicy denying pi-session egress to kube-apiserver.

Phase 2: sandbox-observer Role + poimen-devs RoleBinding for
OIDC-authenticated kubectl access to sandbox pod status/logs.

2026-09-28 23:15:25 +08:00

10 lines

277 B

YAML

Raw Blame History

 apiVersion: v1
 kind: Namespace
 metadata:
   name: poimen-sandbox
   labels:
     pod-security.kubernetes.io/enforce: restricted
     pod-security.kubernetes.io/enforce-version: latest
     pod-security.kubernetes.io/audit: restricted
     pod-security.kubernetes.io/warn: restricted