79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
|
apiVersion: networking.k8s.io/v1
|
||
|
|
kind: NetworkPolicy
|
||
|
|
metadata:
|
||
|
|
name: poimen-frontend-egress
|
||
|
|
namespace: poimen
|
||
|
|
annotations:
|
||
|
|
argocd.argoproj.io/sync-wave: "0"
|
||
|
|
spec:
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app: poimen-frontend
|
||
|
|
policyTypes:
|
||
|
|
- Ingress
|
||
|
|
- Egress
|
||
|
|
|
||
|
|
ingress:
|
||
|
|
# Allow from ingress-nginx controller → frontend on port 3000
|
||
|
|
- from:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: ingress-nginx
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 3000
|
||
|
|
|
||
|
|
egress:
|
||
|
|
# DNS — required for all in-cluster service resolution
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: kube-system
|
||
|
|
ports:
|
||
|
|
- protocol: UDP
|
||
|
|
port: 53
|
||
|
|
- protocol: TCP
|
||
|
|
port: 53
|
||
|
|
|
||
|
|
# api-gw (api namespace) — all server-side LLM + workflow + memory calls
|
||
|
|
# api-gw NetworkPolicy already allows ingress from poimen namespace.
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: api
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 8080
|
||
|
|
|
||
|
|
# Memory service (co-located in poimen namespace) — GraphQL session queries
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: poimen
|
||
|
|
podSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: poimen-memory
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 8080
|
||
|
|
|
||
|
|
# Gotify (notifications namespace) — /api/notify/messages server-side poll
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: notifications
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 80
|
||
|
|
|
||
|
|
# Authentik (iam namespace) — OIDC token fetch + JWKS verification
|
||
|
|
- to:
|
||
|
|
- namespaceSelector:
|
||
|
|
matchLabels:
|
||
|
|
kubernetes.io/metadata.name: iam
|
||
|
|
ports:
|
||
|
|
- protocol: TCP
|
||
|
|
port: 9000
|
||
|
|
- protocol: TCP
|
||
|
|
port: 9443
|