From d998d7e63c49a4bf07eaa89fab41bfd30474b8de Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Fri, 4 Sep 2026 19:06:50 -0700
Subject: [PATCH] fix: add egress rules for iam, sqs, temporal, poimen, storage
 namespaces

---
 k8s/network-policy.yaml | 42 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 9373e16..8ce0f12 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -85,3 +85,45 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
+  # Allow to IAM (Authentik) for JWKS fetch + API
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: iam
+    ports:
+    - protocol: TCP
+      port: 80
+    - protocol: TCP
+      port: 443
+  # Allow to SQS (queue management service)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: sqs
+    ports:
+    - protocol: TCP
+      port: 9090
+  # Allow to Temporal (workflow engine gRPC)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: temporal
+    ports:
+    - protocol: TCP
+      port: 7233
+  # Allow to Poimen (memory/semantic search)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: poimen
+    ports:
+    - protocol: TCP
+      port: 8080
+  # Allow to MinIO (S3-compatible storage)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: storage
+    ports:
+    - protocol: TCP
+      port: 9000