From e0622449cc04d374fc465d980f3aa062347ed9ac Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sun, 13 Sep 2026 11:48:04 +0900
Subject: [PATCH] fix: ensure test pod can reach all downstream services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add labels to test pod to match network policy selectors:
- app=api-gateway (matches network policy pod selector)
- managed-by=argocd (matches network policy pod selector)
- role=test (identify as test pod)
- test-run=<sha> (track which test run spawned it)

Network policy 'api-gateway' in api namespace already allows egress to:
✅ kube-system (DNS resolution)
✅ poimen (port 8080 - Memory service)
✅ temporal (port 7233 - Workflow service)
✅ storage (ports 80, 9000 - S3/MinIO)
✅ sqs (port 9090 - SQS service)
✅ iam (ports 9000, 9443 - Authentik/IAM)

Test pod inherits same network access as production pods via labels.
No additional network policies needed.
---
 .gitea/workflows/ci.yaml      | 1 +
 k8s/integration-test-job.yaml | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 7ad70e8..aa152fc 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -84,6 +84,7 @@ jobs:
             --namespace=api \
             --restart=Never \
             --port=8080 \
+            --labels="app=api-gateway,managed-by=argocd,role=test,test-run=${{ steps.sha.outputs.short_sha }}" \
             --overrides='{"spec":{"containers":[{"name":"gateway","securityContext":{"runAsNonRoot":true,"runAsUser":65532,"allowPrivilegeEscalation":false}}]}}'
           
           echo "Waiting for test pod to be ready..."
diff --git a/k8s/integration-test-job.yaml b/k8s/integration-test-job.yaml
index d6f8243..197abe5 100644
--- a/k8s/integration-test-job.yaml
+++ b/k8s/integration-test-job.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: api
 spec:
   template:
+    metadata:
+      labels:
+        app: api-gateway
+        managed-by: test
+        role: integration-test
     spec:
       serviceAccountName: api-gateway
       restartPolicy: Never