# Default-deny ingress for the serving pods.
#
# This is a real compensating control, not hygiene: vLLM is pinned to v0.11.0
# (forced — last release with Volta kernels), which sits below the patch line on
# several advisories that will never be backported to that branch, incl.
# CVE-2026-54234 (remote DoS) and GHSA-7m6h-x95x-82q5 (cross-user data leak).
# Those are all remote/unauthenticated attack surface, so keeping the engines
# reachable only from opted-in in-cluster clients is what keeps exposure low.
#
# Consumers opt in with label `llm-client: "true"`. Do NOT expose these via
# Ingress.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: llm-serving-default-deny
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: llm-serving
  policyTypes:
    - Ingress
  ingress:
    - from:
        # Any pod, any namespace, that explicitly opts in as an LLM client.
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              llm-client: "true"
        # Sibling engines (harness may chain calls between them).
        - podSelector:
            matchLabels:
              app.kubernetes.io/part-of: llm-serving
      ports:
        - protocol: TCP
          port: 8080
    - from:
        # Prometheus scraping /metrics.
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
      ports:
        - protocol: TCP
          port: 8080