obsidian deployment

cluster/applications/obsidian-vault/networkpolicy.yaml

@@ -0,0 +1,33 @@
+# Requires a CNI that enforces NetworkPolicy. Nothing may call the pod; it may only
+# resolve DNS and reach the Obsidian Sync servers over HTTPS/WebSocket.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: obsidian-vault
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: obsidian-vault
+  policyTypes: ["Ingress", "Egress"]
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - { protocol: UDP, port: 53 }
+        - { protocol: TCP, port: 53 }
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 169.254.169.254/32
+      ports:
+        - { protocol: TCP, port: 443 }