From 427cbcd85c16749592dbd2f600d701c7432d4709 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Wed, 4 Mar 2026 18:59:45 +0100
Subject: [PATCH] fix(argo): add NetworkPolicy and security context for
 workflow pods

The default-deny-all NetworkPolicy blocks all egress for foxhunt-labeled
pods. Argo workflow pods need:
- Egress to MinIO (9000) for binary fetch and result upload
- Egress to K8s API (443/6443) for executor task result reporting
- Egress to Tempo (4317) for OTLP traces
- DNS already covered by allow-dns policy

Also fix PVC permission denied by setting fsGroup: 1000 to match the
foxhunt user (UID 1000) in the runtime images.

Smoke test fetch-binary step: Succeeded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/argo/argo-workflow-netpol.yaml      | 41 +++++++++++++++++++
 infra/k8s/argo/kustomization.yaml             |  1 +
 .../k8s/argo/training-workflow-template.yaml  |  9 ++++
 3 files changed, 51 insertions(+)
 create mode 100644 infra/k8s/argo/argo-workflow-netpol.yaml

diff --git a/infra/k8s/argo/argo-workflow-netpol.yaml b/infra/k8s/argo/argo-workflow-netpol.yaml
new file mode 100644
index 000000000..4579ed53c
--- /dev/null
+++ b/infra/k8s/argo/argo-workflow-netpol.yaml
@@ -0,0 +1,41 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: argo-training-workflow
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: training-workflow
+  policyTypes:
+    - Egress
+  egress:
+    # Kubernetes API — Argo executor reports task results
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 10.32.0.0/16
+        - ipBlock:
+            cidr: 172.16.0.4/32
+    # MinIO — binary fetch + result upload
+    - ports:
+        - port: 9000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio
+    # Tempo — OTLP traces
+    - ports:
+        - port: 4317
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: tempo
diff --git a/infra/k8s/argo/kustomization.yaml b/infra/k8s/argo/kustomization.yaml
index 11e40dc1a..9fcec49be 100644
--- a/infra/k8s/argo/kustomization.yaml
+++ b/infra/k8s/argo/kustomization.yaml
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - training-workflow-template.yaml
+  - argo-workflow-netpol.yaml
diff --git a/infra/k8s/argo/training-workflow-template.yaml b/infra/k8s/argo/training-workflow-template.yaml
index b63783926..885396e2d 100644
--- a/infra/k8s/argo/training-workflow-template.yaml
+++ b/infra/k8s/argo/training-workflow-template.yaml
@@ -9,6 +9,15 @@ metadata:
 spec:
   entrypoint: train-model
   serviceAccountName: argo-workflow
+  # Label all workflow pods so network policies (MinIO, DNS) allow traffic
+  podMetadata:
+    labels:
+      app.kubernetes.io/part-of: foxhunt
+      app.kubernetes.io/component: training-workflow
+  securityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
   ttlStrategy:
     secondsAfterCompletion: 3600
   activeDeadlineSeconds: 21600