fix(netpol): leg tijdelijke allow-all voor rig-prd-operations vast in git

Incident 2026-06-10: de eerste echte toepassing van PR #64 (scoped
allow-argo) onthulde dat geen enkele andere workload in rig-prd-operations
een volledige NetworkPolicy had — de oorspronkelijke allow-argo was
podSelector:{} allow-all en maskeerde alle restrictieve policies sinds dag
één. Keycloak had helemaal geen policy en verloor database- en
github-egress; OPI verloor database-egress; external-dns crashloopte.

Deze policy reproduceert de pre-incident netwerkstaat en is bewust
TIJDELIJK: het verwijderplan staat in het bestand. De kind-sandbox
handhaaft geen NetworkPolicies (kindnet), dus per-component policies
moeten op een handhavende cluster getest worden vóór verwijdering.

Author: uittenbroekrobbert

bootstrap/rig-system/kustomize/overlays/odcn-production/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
 - namespace.yaml
 - argocd-deployment.yaml
 - network-policies/argocd-network-policy.yaml
+- network-policies/emergency-restore-allow-all.yaml
 - ../../operations-manager/overlays/odcn-production
 - argocd-application-production-infrastructure.yaml
 - argocd-application-user-applications.yaml

bootstrap/rig-system/kustomize/overlays/odcn-production/network-policies/emergency-restore-allow-all.yaml

@@ -0,0 +1,32 @@
+# TEMPORARY — DO NOT REMOVE WITHOUT READING THIS
+#
+# Allow-all policy over every pod in rig-prd-operations. This recreates the
+# effective network state production ran under from day one until 2026-06-10:
+# the original `allow-argo` was podSelector:{} allow-all and masked every
+# restrictive policy in the namespace (NetworkPolicies are additive).
+#
+# PR #64 scoped allow-argo down (correct security fix), but the first apply
+# of it (2026-06-10 bootstrap run) revealed that no other workload had a
+# complete policy — Keycloak had none at all — and took production down
+# (incident 2026-06-10: OPI/Keycloak/external-dns lost database and egress).
+#
+# Removal plan (in this order, nothing skipped):
+#   1. Write per-component NetworkPolicies for EVERY workload in this
+#      namespace (keycloak, external-dns, minio, redis, rig-db, OPI, argocd).
+#   2. Test them on a cluster that actually ENFORCES policies — the kind
+#      sandbox runs kindnet, which ignores NetworkPolicies entirely.
+#   3. Apply the per-component policies to production.
+#   4. Only then delete this file and the live object.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: emergency-restore-allow-all
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - {}
+  egress:
+    - {}