NetworkPolicy: allow ingress from mendys-prod to fuzefront-security:3002 (datasets-service token verify)

[izzywdev]

@claude

Context

MendysRobotics datasets-service (ns mendys-prod) authenticates against FuzeFront's Security API. Every authenticated request makes a server-side call to:

http://fuzefront-security.fuzefront.svc.cluster.local:3002/api/v1/security/session

(and later /authz/check + /authz/grants on the same host:port)

If the fuzefront namespace ever gains a default-deny ingress NetworkPolicy, this path will fail closed, breaking mendys marketplace/portal protected pages with redirect-loop to sign-in.

Originating issue: izzywdev/FuzeInfra#339

Ask

Add a NetworkPolicy (or extend an existing one) in the FuzeFront Helm chart to allow:

• Ingress to fuzefront-security pods (ns fuzefront) from namespace mendys-prod, TCP port 3002

The minimal policy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-mendys-prod-to-security
  namespace: fuzefront
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: fuzefront-security   # adjust to actual label
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: mendys-prod
      ports:
        - protocol: TCP
          port: 3002

Check actual pod labels on fuzefront-security pods first — adjust podSelector to match.

Acceptance

• NetworkPolicy in the FuzeFront Helm chart (gated by a values flag, default true)
• PR merged; Argo syncs it to prod
• No FuzeInfra-side change needed

STATE

• Origin: FuzeInfra#339 (cross-repo delegation)
• Remaining: add NetworkPolicy to FuzeFront chart + merge
• If blocked, comment @izzywdev BLOCKED: <question> + updated STATE

🤖 Delegated via FuzeInfra#339 cross-repo @claude protocol

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.