e86384ff99
minio.fxhnt.ai returned 000 — proxy not in minio's ingress allow-list. Same pattern as gitea/postgres. Now reachable over the tailnet (health 200).
128 lines
3.2 KiB
YAML
128 lines
3.2 KiB
YAML
# Postgres: accepts connections from foxhunt app pods, GitLab, Grafana, and Gitea
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: postgres
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgres
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt", "argo-workflows"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
- podSelector: # Gitea (Phase 2B) reuses the in-cluster postgres
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
---
|
|
# Redis: accepts connections from foxhunt app pods + GitLab (Helm release)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: redis
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: redis
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
ports:
|
|
- protocol: TCP
|
|
port: 6379
|
|
---
|
|
# Minio: accepts connections from foxhunt app pods, GitLab, and init jobs
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: minio
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/part-of
|
|
operator: In
|
|
values: ["foxhunt", "foxhunt-ci", "argo-workflows"]
|
|
- podSelector:
|
|
matchLabels:
|
|
release: gitlab
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: minio-init
|
|
- podSelector: # tailscale proxy fronts minio.fxhnt.ai (S3 API)
|
|
matchLabels:
|
|
app.kubernetes.io/name: tailscale-gitlab-proxy
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9000
|
|
---
|
|
# QuestDB: accepts ILP writes from trading-service + Prometheus metrics scrape
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: questdb
|
|
namespace: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: questdb
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: trading-service
|
|
- podSelector:
|
|
matchLabels:
|
|
foxhunt/job-type: training
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9009
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: prometheus
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9003
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8812
|