From 26a5dde12da1e04016201e94e6a6922ce06453b5 Mon Sep 17 00:00:00 2001 From: jenkins Date: Sun, 2 Aug 2026 03:08:20 -0300 Subject: [PATCH] ai(hermes-chat): allow read-only API endpoint access --- services/hermes-chat/networkpolicy.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/services/hermes-chat/networkpolicy.yaml b/services/hermes-chat/networkpolicy.yaml index c6cf5718d..7a5260b99 100644 --- a/services/hermes-chat/networkpolicy.yaml +++ b/services/hermes-chat/networkpolicy.yaml @@ -51,6 +51,18 @@ spec: ports: - protocol: TCP port: 443 + # K3s applies egress policy after Service DNAT, so admit only the fixed API + # server endpoints as well as the kubernetes Service IP above. + - to: + - ipBlock: + cidr: 192.168.22.11/32 + - ipBlock: + cidr: 192.168.22.12/32 + - ipBlock: + cidr: 192.168.22.13/32 + ports: + - protocol: TCP + port: 6443 - to: - ipBlock: cidr: 0.0.0.0/0