From d9b266e1d310e57b7388dc3f8bb3d5f6d7c6b223 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Mon, 2 Mar 2026 22:44:27 +0100
Subject: [PATCH] infra: add monitoring-service network policy, allow
 web-gateway egress

monitoring-service needs egress to Prometheus (port 80/9090) and ingress
from web-gateway (port 50057). web-gateway needs egress to monitoring-service.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../network-policies/monitoring-service.yaml  | 37 +++++++++++++++++++
 infra/k8s/network-policies/web-gateway.yaml   |  8 ++++
 2 files changed, 45 insertions(+)
 create mode 100644 infra/k8s/network-policies/monitoring-service.yaml

diff --git a/infra/k8s/network-policies/monitoring-service.yaml b/infra/k8s/network-policies/monitoring-service.yaml
new file mode 100644
index 000000000..f5ae526bb
--- /dev/null
+++ b/infra/k8s/network-policies/monitoring-service.yaml
@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: monitoring-service
+  namespace: foxhunt
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: monitoring-service
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # gRPC from web-gateway
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: web-gateway
+      ports:
+        - protocol: TCP
+          port: 50057
+  egress:
+    # Prometheus HTTP API (port 80)
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 80
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+      ports:
+        - protocol: TCP
+          port: 9090
diff --git a/infra/k8s/network-policies/web-gateway.yaml b/infra/k8s/network-policies/web-gateway.yaml
index 82ca9eeaa..2db45d085 100644
--- a/infra/k8s/network-policies/web-gateway.yaml
+++ b/infra/k8s/network-policies/web-gateway.yaml
@@ -59,6 +59,14 @@ spec:
       ports:
         - protocol: TCP
           port: 50056
+    # Monitoring service gRPC
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: monitoring-service
+      ports:
+        - protocol: TCP
+          port: 50057
     # Minio (initContainer binary fetch)
     - to:
         - podSelector: