1 changed files with 15 additions and 0 deletions
@@ -66,6 +66,21 @@ spec:
          port: 80
        - protocol: TCP
          port: 8000
    # Allow from poimen namespace (poimen-memory ingest + query).
    # The client-side egress rule is the other half and must stay in step:
    # NetworkPolicy poimen/poimen-memory-llm-egress permits port 8080 to pods
    # labelled part-of=llm-serving, which is the same selector used here. This
    # policy had no matching ingress rule at all, so the packet was allowed out
    # and dropped here. The client then saw a bare timeout and the predictor log
    # stayed empty, which is why this failure looked like a hung inference engine
    # for 34 days.
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: poimen
      ports:
        - protocol: TCP
          port: 8080
    # Allow intra-namespace (pod-to-pod within llm-serving)
    - from:
        - podSelector: