From 500eb745772c5cee21a38623151c3c66b9390408 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:04:17 -0700
Subject: [PATCH] fix: match namespaces by kubernetes.io/metadata.name in
 netpol egress

kube-system and llm-serving carry only the automatic label, so DNS and
upstream egress matched nothing and every dispatch failed with 502.
---
 k8s/network-policy.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 5b29b22..b893680 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -34,15 +34,17 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: kube-system
+          kubernetes.io/metadata.name: kube-system
     ports:
     - protocol: UDP
       port: 53
+    - protocol: TCP
+      port: 53
   # Allow to upstreams (LLM services in llm-serving namespace)
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 80
@@ -54,7 +56,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 8080
@@ -62,7 +64,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: atlas
+          kubernetes.io/metadata.name: atlas
     ports:
     - protocol: TCP
       port: 8080