[Infrastructure] Add network policies & scope Vault permissions per service

[Flegma]

Summary

The cluster lacks network segmentation and secrets management uses overly broad access policies.

Tasks

• Create NetworkPolicies with default-deny for the namespace
• Whitelist only required pod-to-pod communication
• Create per-service Vault policies instead of wildcard
• Implement per-service Vault roles with specific path restrictions

Impact

No network segmentation between pods. Broad secrets access increases compromise blast radius.

Details

Full details in internal audit document. Finding IDs: CRIT-INFRA-03, CRIT-INFRA-04, MED-INFRA-05

---

Related Issues (Security Hardening Pattern)

• [Infrastructure] Tighten RBAC cluster roles & DaemonSet security context #412 — [Infrastructure] Tighten RBAC & DaemonSet security
• [Infrastructure] Add network policies & scope Vault permissions per service #413 — [Infrastructure] Network policies & Vault scoping
• [Connector] Improve offline match endpoint authentication #409 — [Connector] Improve offline match authentication
• [API] Strengthen request authentication and proxy trust validation #372 — [API] Strengthen request authentication

[Flegma]

Re-verified on 2026-07-10: not outdated. Current main still has no NetworkPolicy manifests and the Vault setup is still not scoped per service, so the finding stands.

PR #425 remains the vehicle. It was scoped down in April per review (default-deny and the umbrella allow-ingress dropped; per-service ingress restrictions for TimescaleDB, Redis, Hasura, API, MinIO, Typesense and the connector kept, plus per-service Vault policies). Checked today: it is still mergeable clean against current main, including everything merged since (news, stream security, calendar routes). It has been awaiting re-review since 2026-04-26.

Moving this to "In review" on the board to reflect reality. @lukepolo #425 is ready when you are.