# Master gate. Default off — installing this Blueprint is a no-op until
# flipped. EPIC-5 (#1100) flips it as part of the zero-trust roll-out.
enabled: false

# Catalyst control-plane namespaces that need full ingress/egress so the
# platform itself stays up after default-deny is applied. Operators can
# extend per-Sovereign (e.g. add `gitea`, `harbor`, `loki` if those run
# in their own namespaces).
allowSystemNamespaces:
  - kube-system
  - flux-system
  - cilium
  - cert-manager
  - catalyst
  - openova-system
  - monitoring
  - ingress

# NOTE: Pod-to-Pod within the SAME namespace is NOT handled here. Cilium
# CCNPs can't express "same namespace as the source Pod" without listing
# every namespace explicitly — that's a per-tenant concern that the
# organization-controller (slice C1 of #1095) renders as a per-namespace
# CiliumNetworkPolicy (CNP, not CCNP) at Organization creation time. This
# Blueprint handles only the cluster-wide policies.

# Allow egress to CoreDNS from every namespace (without this, Pods break
# on first DNS lookup).
allowEgressDNS: true
dnsNamespace: kube-system
dnsServiceName: kube-dns
