From b709d31b674b0ef84fef84a980948b0c1d83c416 Mon Sep 17 00:00:00 2001
From: sync-test <dev@traceworks.com>
Date: Mon, 6 Jul 2026 01:50:32 +0530
Subject: [PATCH] feat: Add NetworkPolicy for Ollama security on
 high-performance branch (Task 3)

---
 apps/ollama/base/networkpolicy.yaml | 53 +++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 apps/ollama/base/networkpolicy.yaml

diff --git a/apps/ollama/base/networkpolicy.yaml b/apps/ollama/base/networkpolicy.yaml
new file mode 100644
index 0000000..4d37139
--- /dev/null
+++ b/apps/ollama/base/networkpolicy.yaml
@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-ingress-restriction
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow traffic from users service (port 11434)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: users
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from payments service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: payments
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from nxtgauge-ai-assistant service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: nxtgauge-ai
+          podSelector:
+            matchLabels:
+              app: nxtgauge-ai-assistant
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from within the same namespace (for health checks, etc.)
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 11434