From c73b8740b44b46f4605a00c3066f5f2910d79660 Mon Sep 17 00:00:00 2001
From: sync-test <dev@traceworks.com>
Date: Mon, 6 Jul 2026 01:48:23 +0530
Subject: [PATCH] feat: Add NetworkPolicy for Ollama security (Task 3)

Restricts ingress to Ollama service from users, payments, and nxtgauge-ai-assistant only
---
 apps/ollama/base/kustomization.yaml |  3 +-
 apps/ollama/base/networkpolicy.yaml | 53 +++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 apps/ollama/base/networkpolicy.yaml

diff --git a/apps/ollama/base/kustomization.yaml b/apps/ollama/base/kustomization.yaml
index 31d547e..76b547f 100644
--- a/apps/ollama/base/kustomization.yaml
+++ b/apps/ollama/base/kustomization.yaml
@@ -4,4 +4,5 @@ resources:
   - namespace.yaml
   - pvc.yaml
   - deployment.yaml
-  - service.yaml
\ No newline at end of file
+  - service.yaml
+  - networkpolicy.yaml
\ No newline at end of file
diff --git a/apps/ollama/base/networkpolicy.yaml b/apps/ollama/base/networkpolicy.yaml
new file mode 100644
index 0000000..4d37139
--- /dev/null
+++ b/apps/ollama/base/networkpolicy.yaml
@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-ingress-restriction
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow traffic from users service (port 11434)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: users
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from payments service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: payments
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from nxtgauge-ai-assistant service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: nxtgauge-ai
+          podSelector:
+            matchLabels:
+              app: nxtgauge-ai-assistant
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from within the same namespace (for health checks, etc.)
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 11434