From a11a609985a1ee803245b65499c7574ea2e9741f Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Thu, 3 Sep 2026 20:43:55 -0700
Subject: [PATCH] fix: allow egress to iam namespace for JWKS validation

---
 k8s/network-policy.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 9373e16..2831c4c 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -85,3 +85,11 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
+  # Allow to Authentik for JWT validation (JWKS endpoint)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: iam
+    ports:
+    - protocol: TCP
+      port: 80