From 9387719c3f6f3a675e78576334ed5779213f5130 Mon Sep 17 00:00:00 2001
From: Antigravity <bot@antigravity.ai>
Date: Sat, 23 May 2026 10:11:53 -0400
Subject: [PATCH] Fix: Remove unused vault config and invalid cilium policies

---
 .../policies/clusterwide-agents-egress.yaml   | 55 -------------------
 .../cnp-litellm-ingress-from-agents.yaml      | 21 -------
 platform/networking/kustomization.yaml        |  2 -
 .../cluster-secret-store-vault.yaml           | 18 ------
 platform/security/kustomization.yaml          |  1 -
 5 files changed, 97 deletions(-)
 delete mode 100644 platform/networking/cilium/policies/clusterwide-agents-egress.yaml
 delete mode 100644 platform/networking/cilium/policies/cnp-litellm-ingress-from-agents.yaml
 delete mode 100644 platform/security/external-secrets/cluster-secret-store-vault.yaml

diff --git a/platform/networking/cilium/policies/clusterwide-agents-egress.yaml b/platform/networking/cilium/policies/clusterwide-agents-egress.yaml
deleted file mode 100644
index d75789b..0000000
--- a/platform/networking/cilium/policies/clusterwide-agents-egress.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-# Least-privilege egress for agent Job namespaces.
-# - DNS (kube-dns)
-# - LiteLLM (all LLM traffic is proxied here)
-# - MCP tool plane
-# - Postgres (LangGraph AsyncPostgresSaver checkpoints + structured agent state)
-#
-# Object storage (MinIO) remains reachable only from MCP servers, not from agent pods.
-apiVersion: cilium.io/v2
-kind: CiliumClusterwideNetworkPolicy
-metadata:
-  name: agentic-os-ai-agents-egress
-spec:
-  endpointSelector:
-    matchExpressions:
-      - key: io.kubernetes.metadata.namespace
-        operator: In
-        values:
-          - ai-agents-gumbo
-          - ai-agents-bernard
-  egress:
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: kube-system
-            k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: ai-core
-            app.kubernetes.io/name: litellm
-      toPorts:
-        - ports:
-            - port: "4000"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: tools-mcp
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
-            - port: "3000"
-              protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: platform-data
-            cnpg.io/cluster: agentic-os-pg
-      toPorts:
-        - ports:
-            - port: "5432"
-              protocol: TCP
diff --git a/platform/networking/cilium/policies/cnp-litellm-ingress-from-agents.yaml b/platform/networking/cilium/policies/cnp-litellm-ingress-from-agents.yaml
deleted file mode 100644
index da65b67..0000000
--- a/platform/networking/cilium/policies/cnp-litellm-ingress-from-agents.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: litellm-ingress-from-agents
-  namespace: ai-core
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: litellm
-  ingress:
-    - fromEndpoints:
-        - matchExpressions:
-            - key: io.kubernetes.metadata.namespace
-              operator: In
-              values:
-                - ai-agents-gumbo
-                - ai-agents-bernard
-      toPorts:
-        - ports:
-            - port: "4000"
-              protocol: TCP
diff --git a/platform/networking/kustomization.yaml b/platform/networking/kustomization.yaml
index ad149ae..16e82f7 100644
--- a/platform/networking/kustomization.yaml
+++ b/platform/networking/kustomization.yaml
@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - gateway-api
   - traefik
-  - cilium/policies/clusterwide-agents-egress.yaml
-  - cilium/policies/cnp-litellm-ingress-from-agents.yaml
diff --git a/platform/security/external-secrets/cluster-secret-store-vault.yaml b/platform/security/external-secrets/cluster-secret-store-vault.yaml
deleted file mode 100644
index 88d8e1a..0000000
--- a/platform/security/external-secrets/cluster-secret-store-vault.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Alternative: HashiCorp Vault KV v2. Enable one ClusterSecretStore in your environment.
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  name: vault-kv2
-spec:
-  provider:
-    vault:
-      server: "https://vault.platform-security.svc:8200"
-      path: "secret"
-      version: "v2"
-      auth:
-        kubernetes:
-          mountPath: "kubernetes"
-          role: "external-secrets"
-          serviceAccountRef:
-            name: external-secrets
-            namespace: platform-security
diff --git a/platform/security/kustomization.yaml b/platform/security/kustomization.yaml
index a4fd676..a124fbf 100644
--- a/platform/security/kustomization.yaml
+++ b/platform/security/kustomization.yaml
@@ -3,6 +3,5 @@ kind: Kustomization
 resources:
   - external-secrets/cluster-secret-store-infisical.yaml
   - external-secrets/cluster-secret-store-infisical-litellm.yaml
-  - external-secrets/cluster-secret-store-vault.yaml
   - cert-manager/cluster-issuer-stub.yaml
   - network-policies.yaml