From d7051055f7c15f270047985f4cd8b11beeb342ed Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Mon, 2 Mar 2026 00:33:39 +0100
Subject: [PATCH] fix(k8s): allow minio-init job pods to reach minio via
 NetworkPolicy

The minio-init-buckets job pod has label app.kubernetes.io/name: minio-init
which doesn't match part-of: foxhunt (adding part-of would trigger
default-deny egress). Add explicit ingress allowlist entry for minio-init
pods on the minio NetworkPolicy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/network-policies/infrastructure.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/infra/k8s/network-policies/infrastructure.yaml b/infra/k8s/network-policies/infrastructure.yaml
index bb46aca24..cd6f381b5 100644
--- a/infra/k8s/network-policies/infrastructure.yaml
+++ b/infra/k8s/network-policies/infrastructure.yaml
@@ -50,7 +50,7 @@ spec:
         - protocol: TCP
           port: 6379
 ---
-# Minio: accepts connections from foxhunt app pods + GitLab (S3 API)
+# Minio: accepts connections from foxhunt app pods, GitLab, and init jobs
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -72,6 +72,9 @@ spec:
         - podSelector:
             matchLabels:
               release: gitlab
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: minio-init
       ports:
         - protocol: TCP
           port: 9000