ebe8b41055
Service pods' initContainers need egress to gitlab-webservice-default:8181 to fetch release binaries from the Generic Package Registry. Without this, curl hangs for 2+ minutes then times out (default-deny-all blocks it). Covers all app.kubernetes.io/part-of=foxhunt pods in one policy. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
25 lines
638 B
YAML
25 lines
638 B
YAML
# Allow all foxhunt pods to fetch binaries from GitLab Generic Package Registry.
|
|
# initContainers in services and training jobs use curl to download release binaries
|
|
# from gitlab-webservice-default:8181 (GitLab API).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: gitlab-packages
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: webservice
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8181
|