The neuron-prod namespace runs a default-deny-all NetworkPolicy and
explicit allow-ingress policies for every legitimate service:
allow-mcp-ingress, allow-rest-ingress, allow-marketing-ingress,
allow-daemon-ingress, allow-engram-ingress. There was no equivalent
for dharma — so every request that arrived at Traefik in kube-system
got 502'd at the Service-to-pod hop, even though the dharma pod
itself was healthy and the IngressRoute was correctly defined.
The previous attempt to fix the 502 (PR #1) removed an unrelated
nonexistent certResolver from the IngressRoute. That was real but
not sufficient — the Traefik routing layer was healthy after that
change, but the Service-to-pod NetworkPolicy hop was still denied.
This adds allow-dharma-ingress mirroring allow-mcp-ingress: accepts
traffic from kube-system (Traefik) and from the neuron-prod
namespace itself.
Will Anderson
7aa56dcb1e