Per-deployment policy field overrides via env vars

[csenet]

Summary

The policy at POLICY_URL is centrally managed, which is the right model for fleet-wide consistency — InfoSec owns one file and every cluster gets it. But there are recurring cases where an individual deployment needs to nudge a single field without going through the central change process:

• per-cluster tuning where a fleet-wide default doesn't quite fit the local environment,
• emergency stop-gaps while a proper policy update is in review,
• staging / canary clusters that legitimately want different thresholds from production.

Today the only options are:

1. Host a fork of the policy file ourselves and point POLICY_URL at it. Now we own the fork and have to track upstream changes manually.
2. Mount a ConfigMap at POLICY_FILE. Documented as not surviving — the next refresh re-fetches POLICY_URL and overwrites the cache.

Both are heavy-handed for what's usually a single-field tweak.

Proposal

Container env vars that override individual policy fields after the fetch:

POLICY_DESTINATION_CIDRS=cidr1,cidr2,...
POLICY_RATE_LIMIT_PPS=N
POLICY_PEER_SYN_RATE_PPS=N

Unset / empty means "use the upstream value" so it's a no-op for operators not opting in. The central baseline stays the source of truth for every other field.

Happy to send a PR if this sounds reasonable.

[csenet]

Nice — makes sense as a per-deployment escape hatch without breaking the central-baseline model. Will add to v2.5.0-rc.1 (pre-release, opt-in via image tag pin). Schema unchanged, no behavior change for operators not setting any of the new env vars. PR coming.