Fix: Remove unused vault config and invalid cilium policies

platform/networking/cilium/policies/clusterwide-agents-egress.yaml

@@ -1,55 +0,0 @@
-# Least-privilege egress for agent Job namespaces.
-# - DNS (kube-dns)
-# - LiteLLM (all LLM traffic is proxied here)
-# - MCP tool plane
-# - Postgres (LangGraph AsyncPostgresSaver checkpoints + structured agent state)
-#
-# Object storage (MinIO) remains reachable only from MCP servers, not from agent pods.
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: agentic-os-ai-agents-egress
-spec:
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.metadata.namespace
-        operator: In
-        values:
-          - ai-agents-gumbo
-          - ai-agents-bernard
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: ai-core
-            app.kubernetes.io/name: litellm
-      toPorts:
-        - ports:
-            - port: "4000"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: tools-mcp
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
-            - port: "3000"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: platform-data
-            cnpg.io/cluster: agentic-os-pg
-      toPorts:
-        - ports:
-            - port: "5432"
-              protocol: TCP

platform/networking/cilium/policies/cnp-litellm-ingress-from-agents.yaml

@@ -1,21 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: litellm-ingress-from-agents
-  namespace: ai-core
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: litellm
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.metadata.namespace
-              operator: In
-              values:
-                - ai-agents-gumbo
-                - ai-agents-bernard
-      toPorts:
-        - ports:
-            - port: "4000"
-              protocol: TCP

platform/networking/kustomization.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - gateway-api
   - traefik
-  - cilium/policies/clusterwide-agents-egress.yaml
-  - cilium/policies/cnp-litellm-ingress-from-agents.yaml

platform/security/external-secrets/cluster-secret-store-vault.yaml

@@ -1,18 +0,0 @@
-# Alternative: HashiCorp Vault KV v2. Enable one ClusterSecretStore in your environment.
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  name: vault-kv2
-spec:
-  provider:
-    vault:
-      server: "https://vault.platform-security.svc:8200"
-      path: "secret"
-      version: "v2"
-      auth:
-        kubernetes:
-          mountPath: "kubernetes"
-          role: "external-secrets"
-          serviceAccountRef:
-            name: external-secrets
-            namespace: platform-security

platform/security/kustomization.yaml

@@ -3,6 +3,5 @@ kind: Kustomization
 resources:
   - external-secrets/cluster-secret-store-infisical.yaml
   - external-secrets/cluster-secret-store-infisical-litellm.yaml
-  - external-secrets/cluster-secret-store-vault.yaml
   - cert-manager/cluster-issuer-stub.yaml
   - network-policies.yaml