Resolve "Update Vault NetworkPolicies"

Package Merge Request

Package Changes

Adding in more restrictive network policies

Package MR

https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/vault/-/merge_requests/19

For Issue

Closes #944 (closed)

added priority6 statusdoing teamXForce vault labels

assigned to @michaelmartin

added 1 commit

• eef233c4 - pass controlPlaneCidr to vault and package version bump

Compare with previous version

added 20 commits

• eef233c4...db4e2b37 - 19 commits from branch master
• 3946854b - Merge remote-tracking branch 'origin/master' into

Compare with previous version

@michaelmartin Just curious, what does vault need API egress for? Was this blocking any access, or just a missing value for a NP present in the package.

added 5 commits

• 3946854b...49fed069 - 4 commits from branch master
• 171573b5 - Merge remote-tracking branch 'origin/master' into 944-update-vault-networkpolicies

Compare with previous version

changed the description

resolved all threads

marked this merge request as ready

added Big Bang Add-Ons label

removed Big Bang Add-Ons label

added statusreview label and removed statusdoing label

mentioned in issue #944 (closed)

Will open another issue to investigate using Istio ServiceEntries to further limit the 0.0.0.0/0 traffic from vault pods.

Also Vault specific NetworkPolicy allowing egress to 0.0.0.0/0 should not be accessing controlPlaneCidr but should stay 0.0.0.0/0 to allow AWS API access that we can further limit with a Istio AuthorizationPolicy or ServiceEntry

If a customer consumes this update and has controlPlaneCidr set to a private address and doesn't have configured Endpoints setup for AWS KMS then they will be blocked.

added statusdoing label and removed statusreview label

added 35 commits

• 171573b5...a4f08449 - 34 commits from branch master
• ea05d780 - Merge remote-tracking branch 'origin/master' into 944-update-vault-networkpolicies

Compare with previous version

closing this mr out. issues resolved by changes in https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/vault/-/merge_requests/20

closed