From bbfb39f06625d3a24525cb31ab35fbb954e13417 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 29 Mar 2026 22:33:28 +0200
Subject: [PATCH] fix(infra): add DNS + GitLab + pushgateway + registry to
 training netpol

argo-training-workflow was missing DNS egress (port 53), causing
MinIO hostname resolution to timeout. Also missing GitLab SSH (2222),
GitLab API (8181), Pushgateway (9091), and Registry (5000).

Now matches the gpu-test-workflow netpol which works correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 infra/k8s/argo/argo-workflow-netpol.yaml | 46 +++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/infra/k8s/argo/argo-workflow-netpol.yaml b/infra/k8s/argo/argo-workflow-netpol.yaml
index a38d1dbd4..4d2ce0e98 100644
--- a/infra/k8s/argo/argo-workflow-netpol.yaml
+++ b/infra/k8s/argo/argo-workflow-netpol.yaml
@@ -12,6 +12,12 @@ spec:
   policyTypes:
     - Egress
   egress:
+    # DNS — required for hostname resolution (minio, gitlab, etc.)
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
     # Kubernetes API — Argo executor reports task results
     - ports:
         - port: 443
@@ -23,7 +29,29 @@ spec:
             cidr: 10.32.0.0/16
         - ipBlock:
             cidr: 172.16.0.4/32
-    # MinIO — binary fetch + result upload
+    # HTTPS (external registries, etc.)
+    - ports:
+        - port: 443
+          protocol: TCP
+    # GitLab SSH — git clone
+    - ports:
+        - port: 2222
+          protocol: TCP
+      to:
+        - ipBlock:
+            cidr: 100.90.76.85/32
+        - podSelector:
+            matchLabels:
+              app: gitlab-shell
+    # GitLab API — binary fetch from packages
+    - ports:
+        - port: 8181
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: webservice
+    # MinIO — log archival + result upload
     - ports:
         - port: 9000
           protocol: TCP
@@ -31,6 +59,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: minio
+    # Pushgateway — Prometheus metrics
+    - ports:
+        - port: 9091
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pushgateway
     # Tempo — OTLP traces
     - ports:
         - port: 4317
@@ -47,6 +83,14 @@ spec:
         - podSelector:
             matchLabels:
               app.kubernetes.io/name: mattermost
+    # Container registry — image pulls
+    - ports:
+        - port: 5000
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: registry
 ---
 # Compile workflow pods: need GitLab SSH, MinIO, k8s API, external HTTPS (cargo deps)
 apiVersion: networking.k8s.io/v1