CloudTaserPolicy CRD

The CloudTaserPolicy custom resource defines fine-grained security policies controlling which CloudTaser Secretstore (OpenBao or HashiCorp Vault) paths are accessible, the eBPF enforcement level, and which secrets are allowed for targeted workloads.

---

API Details

Field	Value
API Group	api.cloudtaser.io
API Version	v1alpha1
Kind	CloudTaserPolicy
Short Name	ctp
Scope	Namespaced

# List all CloudTaserPolicy resources
kubectl get ctp -A

# Describe a specific policy
kubectl describe ctp my-policy -n production

---

Spec Fields

vaultPaths

Type	[]string
Required	Yes
Min items	1

Lists the Secretstore paths this policy allows access to. Pods in the namespace may only request secrets from these paths. Only exact relative path prefixes and prefixes with a trailing wildcard are allowed.

spec:
  vaultPaths:
    - "secret/data/myapp"
    - "secret/data/shared/*"

secretAllowlist

Type	[]string
Required	No

Lists specific secret key names that pods may access within paths allowed by vaultPaths. If empty, all keys within those paths are allowed.

spec:
  secretAllowlist:
    - "password"
    - "api_key"

ebpfEnforcement

Type	string
Required	No
Default	enforce
Enum	enforce, alert, disabled

Sets the eBPF runtime enforcement level for targeted workloads.

• enforce (default): full enforcement -- block /proc/environ, /proc/mem, ptrace
• alert: log violations but do not block
• disabled: no eBPF enforcement (not recommended for production)

Deprecated aliases accepted for one release cycle: strict maps to enforce, permissive maps to alert.

spec:
  ebpfEnforcement: enforce

allowUnenforcedUnderPSA

Type	boolean
Required	No
Default	false

Permits protected pods in namespaces enforcing Pod Security Admission baseline/restricted to be admitted when PSA blocks the eBPF agent socket hostPath injection. The default false denies those pods so runtime eBPF enforcement cannot silently disappear.

spec:
  allowUnenforcedUnderPSA: true

volumeShield

Type	object
Required	No

Controls Volume Shield-specific policy guardrails.

Sub-field	Type	Default	Description
allowFreshnessLocal	boolean	false	Admission-side guardrail for cloudtaser.io/vs-freshness=local. Leave false: current wrapper releases refuse local at mount setup regardless of this value

spec:
  volumeShield:
    allowFreshnessLocal: false

namespaceSelector

Type	LabelSelector
Required	No

Retained for API compatibility but rejected by CEL validation on this namespaced resource: policies always apply only to their own namespace. Setting this field causes the API server to reject the resource.

---

Status Fields

The status subresource is managed by the operator and is read-only.

ready

Type	boolean

Indicates whether the policy has been validated and is active.

affectedNamespaces

Type	integer

The count of namespaces matching the policy's selector.

conditions

Type	[]metav1.Condition

Standard Kubernetes conditions providing detailed status information about the policy.

---

Full Example

apiVersion: api.cloudtaser.io/v1alpha1
kind: CloudTaserPolicy
metadata:
  name: production-policy
  namespace: production
spec:
  vaultPaths:
    - "secret/data/production/*"
  secretAllowlist:
    - "database_password"
    - "api_key"
  ebpfEnforcement: enforce
  allowUnenforcedUnderPSA: false
  volumeShield:
    allowFreshnessLocal: false