From 0d8e59caf505e1c26738d6b5bb8d6276adbcaa8d Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sat, 7 Mar 2026 13:22:48 +0100
Subject: [PATCH] fix(infra): add NetworkPolicy for data-download jobs, fix pod
 labels

The download job pod was missing app.kubernetes.io/part-of: foxhunt,
so the default-deny-all egress policy blocked it and MinIO's ingress
policy rejected it. Also removed hostname pinning (was a misdiagnosis).

Added data-download-job NetworkPolicy allowing egress to MinIO:9000
and external HTTPS:443 (Databento API).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../network-policies/data-download-job.yaml   | 36 +++++++++++++++++++
 infra/k8s/training/download-mbp10-job.yaml    |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 infra/k8s/network-policies/data-download-job.yaml

diff --git a/infra/k8s/network-policies/data-download-job.yaml b/infra/k8s/network-policies/data-download-job.yaml
new file mode 100644
index 000000000..679c77564
--- /dev/null
+++ b/infra/k8s/network-policies/data-download-job.yaml
@@ -0,0 +1,36 @@
+# Egress policy for data-download jobs (MBP-10 download, etc.)
+# Allows: MinIO (upload), Databento API (HTTPS download)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: data-download-job
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      foxhunt/job-type: data-download
+  policyTypes:
+    - Egress
+  egress:
+    # MinIO — binary fetch + data upload
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+      ports:
+        - protocol: TCP
+          port: 9000
+    # Databento API (HTTPS)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 100.64.0.0/10
+      ports:
+        - protocol: TCP
+          port: 443
diff --git a/infra/k8s/training/download-mbp10-job.yaml b/infra/k8s/training/download-mbp10-job.yaml
index 4937cc080..ccb1ba57c 100644
--- a/infra/k8s/training/download-mbp10-job.yaml
+++ b/infra/k8s/training/download-mbp10-job.yaml
@@ -35,6 +35,7 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: download-mbp10
+        app.kubernetes.io/part-of: foxhunt
         foxhunt/job-type: data-download
     spec:
       nodeSelector: