23a122607d
- Argo workflow archive via PostgreSQL — persistent logs after pod GC - Allow Argo controller to reach PostgreSQL via network policy - Allow Argo server to reach MinIO for S3 log archival - Replace foxhunt-runtime with lightweight images (alpine:3.21, curlimages/curl) in orchestration steps: fetch-binary, upload-results, detect-changes, gpu-warmup - Use ci-builder for training steps (hyperopt, train-best, evaluate) — nvcc required - Fix --hyperopt-results → --hyperopt-params flag in train-best step - Remove invalid podGCGracePeriod from Argo Helm values - Archive RBAC, kustomization updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
122 lines
2.9 KiB
YAML
122 lines
2.9 KiB
YAML
# Postgres: accepts connections from foxhunt app pods, GitLab, and Grafana
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: postgres
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgres
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt", "argo-workflows"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
---
|
|
# Redis: accepts connections from foxhunt app pods + GitLab (Helm release)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: redis
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: redis
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
ports:
|
|
- protocol: TCP
|
|
port: 6379
|
|
---
|
|
# Minio: accepts connections from foxhunt app pods, GitLab, and init jobs
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: minio
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt", "foxhunt-ci", "argo-workflows"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio-init
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9000
|
|
---
|
|
# QuestDB: accepts ILP writes from trading-service + Prometheus metrics scrape
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: questdb
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: questdb
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: trading-service
|
|
- podSelector:
|
|
matchLabels:
|
|
foxhunt/job-type: training
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9009
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: prometheus
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9003
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8812
|