Add labels to test pod to match network policy selectors:
- app=api-gateway (matches network policy pod selector)
- managed-by=argocd (matches network policy pod selector)
- role=test (identify as test pod)
- test-run=<sha> (track which test run spawned it)
Network policy 'api-gateway' in api namespace already allows egress to:
✅ kube-system (DNS resolution)
✅ poimen (port 8080 - Memory service)
✅ temporal (port 7233 - Workflow service)
✅ storage (ports 80, 9000 - S3/MinIO)
✅ sqs (port 9090 - SQS service)
✅ iam (ports 9000, 9443 - Authentik/IAM)
Test pod inherits same network access as production pods via labels.
No additional network policies needed.
Add integration test suite that tests against production cluster:
- Memory service (ingest, query)
- S3 adapter (list, put objects)
- SQS adapter (list queues with auth enforcement)
- Workflow adapter (gRPC ListWorkflowExecutions)
- IAM adapter (list users)
- Health endpoints (liveness, readiness)
Update CI/CD pipeline:
- Build new docker image from commit
- Push to registry with commit SHA and latest tags
- Deploy test job to cluster to run integration tests
- Tests run against actual production services
- Cleanup test resources after completion
Add Kubernetes Job manifest:
- Runs integration tests in dedicated pod
- Waits for gateway to be ready before testing
- Tests all adapters and downstream services
- Can be run manually: kubectl apply -f k8s/integration-test-job.yaml
Admin Bot