feat: Add NetworkPolicy for Ollama security (Task 3)

Restricts ingress to Ollama service from users, payments, and nxtgauge-ai-assistant only

apps/ollama/base/kustomization.yaml

@@ -4,4 +4,5 @@ resources:
   - namespace.yaml
   - pvc.yaml
   - deployment.yaml
-  - service.yaml
+  - service.yaml
+  - networkpolicy.yaml

apps/ollama/base/networkpolicy.yaml

@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-ingress-restriction
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow traffic from users service (port 11434)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: users
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from payments service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: payments
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from nxtgauge-ai-assistant service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: nxtgauge-ai
+          podSelector:
+            matchLabels:
+              app: nxtgauge-ai-assistant
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from within the same namespace (for health checks, etc.)
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 11434