rock
cc5f8b8e60
Replace hand-applied llm-serving-default-deny NetworkPolicy that used llm-client=true pod label selector (any pod in any namespace could self-grant access) with a proper namespace-scoped policy. Ingress now restricted to: - api namespace (gateway) on ports 8080/80/8000/11434 - monitoring namespace (Prometheus) on ports 8080/9000 - intra-namespace (pod-to-pod within llm-serving) Tested live: - Gateway -> reasoning/ornith/embeddings/reranker: 200 OK - default namespace -> llm-serving: timeout (blocked) - portfolio namespace -> llm-serving: timeout (blocked) Closes #13
20 lines
910 B
YAML
20 lines
910 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Explicit allowlist, matching k8s/apps/api. Anything added to this directory
|
|
# and not listed here is silently dropped — no error, no drift shown.
|
|
#
|
|
# These five were adopted from live state on 2026-08-15; they had been applied
|
|
# by hand and carried no ArgoCD ownership. Each was exported and verified with
|
|
# `kubectl diff -f <file>` returning empty before the Application below was
|
|
# created, so the first sync was a no-op rather than a redeploy. Re-verify that
|
|
# way after any edit here: a GPU predictor restart is a weights reload measured
|
|
# in tens of seconds, not a rolling update.
|
|
resources:
|
|
- embeddings.yaml
|
|
- ornith.yaml
|
|
- reasoning.yaml
|
|
- reranker.yaml
|
|
- networkpolicy.yaml
|
|
# No namespace transformer: every file sets its own, and the transformer would
|
|
# rewrite metadata.namespace on anything cross-namespace added later.
|