Harden Ray cluster isolation: NetworkPolicy authz boundary, securityContext, quotas - #28

Open

brandonrc wants to merge 9 commits into

mainfrom

geraci/harden-ray-isolation

Commits on Aug 5, 2026

feat: harden Ray cluster isolation (ServiceAccount, securityContext, NetworkPolicy, quotas)
brandonrc
committed
ca58e15
docs: Security section, ArgoCD ignoreDifferences warning for hardening fields, NOTES
brandonrc
committed
db78bc7
ci: netpol/quota/scheduling lint permutations, Calico-enforced NetworkPolicy kind job
brandonrc
committed
44eb85f
chore: bump chart to 0.5.0
brandonrc
committed
2ce7dd9
docs: link mTLS follow-up issue #29
brandonrc
committed
794de04
fix: stale pre-rename service names; keep NetworkPolicy out of port-forward jobs
brandonrc
committed
32cabe9
fix: integration workflow asserted pre-rename NebariApp names
brandonrc
committed
2042fb4
ci: retry the netpol allow-path test — Calico lags new-namespace label matches
brandonrc
committed
14229a9
ci: carry install-time overrides through the auth-upgrade step
brandonrc
committed
94422d7