cloudtaser-cli target netpol

Generates Kubernetes NetworkPolicy YAML that restricts direct access to the OpenBao endpoint. Only pods with the cloudtaser.io/protected=true label are allowed to reach the secret store.

The generated policies are written to stdout as multi-document YAML. Review and apply them with kubectl.

System namespaces (kube-system, kube-public, kube-node-lease) are excluded.

Usage

cloudtaser-cli target netpol [flags]

Examples

# Generate policies for all namespaces (P2P beacon mode — uses
  # beacon egress only; pass --secretstore-address to also include legacy
  # direct-vault egress when needed)
  cloudtaser-cli target netpol

  # Generate for a specific namespace
  cloudtaser-cli target netpol -n production

  # Legacy direct-vault: include vault egress in addition to beacon
  cloudtaser-cli target netpol --secretstore-address https://vault.eu.example.com

  # Override the secret store CIDR instead of DNS resolution
  cloudtaser-cli target netpol --secretstore-address https://vault.eu.example.com --secretstore-cidr 10.0.1.50/32

  # Apply directly
  cloudtaser-cli target netpol | kubectl apply -f -

Flags

Flag	Type	Default	Required	Description
--help, -h	bool	false	no	help for netpol
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	no	namespace to generate policies for (default: all namespaces)
--secretstore-address	string	(empty)	no	secret store endpoint address (optional, only when including legacy direct-vault egress; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-cidr	string	(empty)	no	secret store network CIDR allowed by the generated policy
--secretstore-port	int	8200	no	secret store service port
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands