spb/uqo-chat

1apiVersion: networking.k8s.io/v12kind: NetworkPolicy3metadata: { name: default-deny, namespace: uqo-chat }4spec: { podSelector: {}, policyTypes: [Ingress, Egress] }5---6apiVersion: networking.k8s.io/v17kind: NetworkPolicy8metadata: { name: sandbox-no-egress, namespace: uqo-chat }9spec:10  podSelector: { matchLabels: { app: sandbox-runner } }11  policyTypes: [Ingress, Egress]12  ingress: [{ from: [{ podSelector: { matchLabels: { app: api } } }, { podSelector: { matchLabels: { app: worker } } }], ports: [{ port: 8080 }] }]13  egress: []   # deny-all egress: executed code has no network14---15apiVersion: networking.k8s.io/v116kind: NetworkPolicy17metadata: { name: api-egress, namespace: uqo-chat }18spec:19  podSelector: { matchLabels: { app: api } }20  policyTypes: [Ingress, Egress]21  ingress: [{ from: [{ podSelector: { matchLabels: { app: web } } }, { namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: ngrok-operator } } }] }]22  egress:23    - { to: [{ podSelector: { matchLabels: { app: postgres } } }], ports: [{ port: 5432 }] }24    - { to: [{ podSelector: { matchLabels: { app: redis } } }], ports: [{ port: 6379 }] }25    - { to: [{ podSelector: { matchLabels: { app: minio } } }], ports: [{ port: 9000 }] }26    - { to: [{ podSelector: { matchLabels: { app: sandbox-runner } } }], ports: [{ port: 8080 }] }27    - { to: [{ namespaceSelector: {} , podSelector: { matchLabels: { k8s-app: kube-dns } } }], ports: [{ port: 53, protocol: UDP }] }28    - { to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] } }], ports: [{ port: 443 }] }   # OpenRouter, Firecrawl29