rock
227839c27a
- Merge poimen-workflows + poimen-memory + db + frontend into one app - Delete duplicate apps: poimen-workflows, poimen-memory-app (kubectl done) - Delete poimen-memory ArgoCD app file (replaced by multi-source source 2) - Delete poimen-memory-database (replaced by source 3 → k8s/infra/poimen/) - Move memory-db CNPG cluster to k8s/infra/poimen/ (isolated from other tenants) - Remove memory-db from k8s/infra/databases/kustomization.yaml - Add frontend manifests (Deployment, Service, Ingress) to k8s/apps/poimen/ - Add frontend NetworkPolicy: egress to api-gw (api:8080), memory (poimen:8080), Gotify (notifications:80), Authentik (iam:9000/9443), DNS (kube-system:53) - Sync-wave -1 on CNPG cluster ensures DB ready before app pods (wave 0) - Image updater: workflows + memory + frontend tracked in one annotation block - poimen-toolkit stays separate (CRD management, independent rollback)
79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: poimen-frontend-egress
|
|
namespace: poimen
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: poimen-frontend
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
|
|
ingress:
|
|
# Allow from ingress-nginx controller → frontend on port 3000
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
ports:
|
|
- protocol: TCP
|
|
port: 3000
|
|
|
|
egress:
|
|
# DNS — required for all in-cluster service resolution
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
|
|
# api-gw (api namespace) — all server-side LLM + workflow + memory calls
|
|
# api-gw NetworkPolicy already allows ingress from poimen namespace.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: api
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
|
|
# Memory service (co-located in poimen namespace) — GraphQL session queries
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: poimen
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: poimen-memory
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
|
|
# Gotify (notifications namespace) — /api/notify/messages server-side poll
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: notifications
|
|
ports:
|
|
- protocol: TCP
|
|
port: 80
|
|
|
|
# Authentik (iam namespace) — OIDC token fetch + JWKS verification
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: iam
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9000
|
|
- protocol: TCP
|
|
port: 9443
|