opened ports

manifests/policy/allow-browser-ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+    name: allow-browser-ingress
+    namespace: ai
+spec:
+    podSelector:
+        matchLabels:
+            app: browser
+    policyTypes: ["Ingress"]
+    ingress:
+        - from:
+              - ipBlock:
+                    cidr: 0.0.0.0/0
+          ports:
+              - { protocol: TCP, port: 7788 }
+

manifests/policy/allow-ollama-scheduler-ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+    name: allow-ollama-scheduler-ingress
+    namespace: argo
+spec:
+    podSelector:
+        matchLabels:
+            app: ollama-scheduler
+    policyTypes: ["Ingress"]
+    ingress:
+        - from:
+              - ipBlock:
+                    cidr: 0.0.0.0/0
+          ports:
+              - { protocol: TCP, port: 12253 }
+

manifests/policy/allow-openwebui-ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+    name: allow-openwebui-ingress
+    namespace: ai
+spec:
+    # Select the Open WebUI pods deployed by the Helm release "openwebui"
+    podSelector:
+        matchLabels:
+            app.kubernetes.io/instance: openwebui
+    policyTypes: ["Ingress"]
+    ingress:
+        - from:
+              - ipBlock:
+                    cidr: 0.0.0.0/0
+          ports:
+              # Open WebUI typically listens on 8080 (chart default), sometimes 80
+              - { protocol: TCP, port: 8080 }
+              - { protocol: TCP, port: 80 }
+

manifests/policy/default-deny.yaml

@@ -1,6 +1,8 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
-metadata: { name: default-deny-all, namespace: ai }
+metadata:
+    name: default-deny-all
+    namespace: ai
 spec:
-    podSelector: {}
+    podSelector: {} # die
     policyTypes: ["Ingress", "Egress"]