From de34a6c8cc01c7f2e174d8e1bb070cccdb7e3b63 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Mon, 31 Aug 2026 14:59:29 -0700
Subject: [PATCH] fix(network): allow poimen namespace to access api-gateway

Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.

The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)

Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)

This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.

Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.
---
 k8s/network-policy.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index b893680..0a7cdb1 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -29,6 +29,15 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
+  # Allow from poimen namespace (orchestrator & worker pods)
+  # Enable Poimen workflows to call the LLM API gateway
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: poimen
+    ports:
+    - protocol: TCP
+      port: 8080
   egress:
   # Allow DNS
   - to: