From a64860064bf5d65ae71da8dbdb7a9284332f0dd0 Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Mon, 4 May 2026 21:16:01 +0000
Subject: [PATCH] fix(neuron-prod): add allow-dharma-ingress NetworkPolicy (#6)

---
 .../prod/network-policy.yaml                  | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml b/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
index 3352c1f..50af280 100644
--- a/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
@@ -117,6 +117,32 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: neuron-prod
 ---
+# ── dharma: accept from Traefik (kube-system) and neuron-prod namespace ──────
+# The dharma pod was healthy and the IngressRoute was correct, but cross-
+# namespace ingress from kube-system (Traefik) was denied by default-deny-all,
+# so every external request landed at Traefik and bounced back as 502. This
+# allow rule mirrors `allow-mcp-ingress` and brings dharma into line with the
+# other neuron-prod services.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dharma-ingress
+  namespace: neuron-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: dharma
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: neuron-prod
+---
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1