From c7da8ca7271b89ef999e6f23e0e6614049b68e7b Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Mon, 4 May 2026 10:49:55 -0500
Subject: [PATCH] fix dharma startup: allow neuron-daemon ingress from
 neuron-prod namespace

The default-deny-all NetworkPolicy was blocking dharma from reaching
neuron-daemon port 7750 (event queue / engram endpoint). Add an explicit
ingress policy for neuron-daemon that allows traffic from the neuron-prod
namespace, so dharma and other internal services can connect at startup.
---
 .../prod/network-policy.yaml                  | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml b/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
index 7f9dec9..d1bfe3d 100644
--- a/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/network-policy.yaml
@@ -78,6 +78,27 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
 ---
+# ── neuron-daemon: accept from neuron-prod namespace (dharma, mcp, etc.) ─────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-daemon-ingress
+  namespace: neuron-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: neuron-daemon
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: neuron-prod
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+---
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1