From 09e10db99b4ba6b22e59f6ddf6c3b98ae8d2c9d7 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Tue, 28 Apr 2026 22:13:32 +0200
Subject: [PATCH] fix(argo): add egress NetworkPolicy for sanitizer-test +
 nsys-test workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both new workflow components were missing egress permissions and the
default-deny in the foxhunt namespace blocked their git fetch SSH to
gitlab-shell.foxhunt.svc.cluster.local:2222 — caused exit code 128
"Could not read from remote repository" before any GPU work started.

New `argo-sanitizer-nsys-workflow` policy mirrors the ci-pipeline
egress (DNS, K8s API, gitlab SSH on port 2222, MinIO 9000 for log
archive + nsys-rep upload, gitlab registry 5000 for ci-builder image
pull, webservice 8181 for registry token auth, external 80/443 for
mc binary download from dl.min.io).
---
 infra/k8s/argo/argo-workflow-netpol.yaml | 77 ++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/infra/k8s/argo/argo-workflow-netpol.yaml b/infra/k8s/argo/argo-workflow-netpol.yaml
index 90b6d421f..24493a63e 100644
--- a/infra/k8s/argo/argo-workflow-netpol.yaml
+++ b/infra/k8s/argo/argo-workflow-netpol.yaml
@@ -438,3 +438,80 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: mattermost
+---
+# ── sanitizer-test + nsys-test workflows: same egress as ci-pipeline ──
+# (git fetch over SSH, MinIO log archive + nsys-rep upload, registry image pull,
+# external HTTPS for mc download)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: argo-sanitizer-nsys-workflow
+  namespace: foxhunt
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - sanitizer-test
+          - nsys-test
+  policyTypes:
+    - Egress
+  egress:
+    # DNS
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Kubernetes API
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 10.32.0.0/16
+        - ipBlock:
+            cidr: 172.16.0.4/32
+    # External HTTPS — mc binary download from dl.min.io
+    - ports:
+        - port: 80
+          protocol: TCP
+        - port: 443
+          protocol: TCP
+    # GitLab SSH — git fetch
+    - ports:
+        - port: 2222
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 100.90.76.85/32
+        - podSelector:
+            matchLabels:
+              app: gitlab-shell
+    # MinIO — log archive + nsys profile upload
+    - ports:
+        - port: 9000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+    # GitLab registry — ci-builder image pull
+    - ports:
+        - port: 5000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: registry
+    # GitLab webservice — JWT auth for registry tokens
+    - ports:
+        - port: 8181
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: webservice