c73b8740b4
All checks were successful
sync-to-forgejo / sync (push) Successful in 22s
Restricts ingress to Ollama service from users, payments, and nxtgauge-ai-assistant only
53 lines
1.2 KiB
YAML
53 lines
1.2 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: ollama-ingress-restriction
|
|
namespace: nxtgauge-ai
|
|
labels:
|
|
app: ollama
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: ollama
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
# Allow traffic from users service (port 11434)
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: default
|
|
podSelector:
|
|
matchLabels:
|
|
app: users
|
|
ports:
|
|
- protocol: TCP
|
|
port: 11434
|
|
# Allow traffic from payments service
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: default
|
|
podSelector:
|
|
matchLabels:
|
|
app: payments
|
|
ports:
|
|
- protocol: TCP
|
|
port: 11434
|
|
# Allow traffic from nxtgauge-ai-assistant service
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: nxtgauge-ai
|
|
podSelector:
|
|
matchLabels:
|
|
app: nxtgauge-ai-assistant
|
|
ports:
|
|
- protocol: TCP
|
|
port: 11434
|
|
# Allow traffic from within the same namespace (for health checks, etc.)
|
|
- from:
|
|
- podSelector: {}
|
|
ports:
|
|
- protocol: TCP
|
|
port: 11434
|