Ingress Policies

Ingress policies control which pods and namespaces can send traffic to MATIH services. Each service defines its own ingress rules based on its documented API consumers, ensuring that only authorized sources can reach service endpoints.

Ingress Policy Pattern

Every service NetworkPolicy includes three standard ingress rules:

ingress:
  # 1. Allow traffic from NGINX Ingress Controller
  - from:
      - namespaceSelector:
          matchLabels:
            name: matih-ingress
    ports:
      - protocol: TCP
        port: 8000
 
  # 2. Allow traffic from same namespace
  - from:
      - podSelector: {}
    ports:
      - protocol: TCP
        port: 8000
 
  # 3. Allow Prometheus scraping
  - from:
      - namespaceSelector:
          matchLabels:
            name: matih-monitoring
    ports:
      - protocol: TCP
        port: 8000

AI Service Ingress Rules

The AI Service networkpolicy.yaml template allows ingress from:

Source	Namespace Label	Port	Purpose
NGINX Ingress	`name: matih-ingress`	8000	External API traffic
Same namespace pods	Any in namespace	8000	Inter-service calls
Prometheus	`name: matih-monitoring`	8000	Metrics scraping

Service-Specific Ingress

Service	Additional Ingress Sources	Reason
API Gateway	External ingress controller	Frontend traffic
AI Service	API Gateway, BI Workbench	Chat and agent API calls
Query Engine	AI Service, BI Service	SQL query execution
Kafka	AI Service, Audit Service	Event production and consumption
Redis	AI Service, Session Service	Cache and session access
Qdrant	AI Service	Vector search queries
PostgreSQL	All data plane services	Database connections

Restricting by Pod Labels

For fine-grained control, ingress rules can match specific pod labels:

ingress:
  - from:
      - podSelector:
          matchLabels:
            app: api-gateway
    ports:
      - protocol: TCP
        port: 8000

This is more restrictive than allowing all pods in the namespace and is used for security-sensitive services.

Cross-Namespace Ingress

Cross-namespace ingress requires both namespaceSelector and optionally podSelector:

ingress:
  - from:
      - namespaceSelector:
          matchLabels:
            name: matih-system
        podSelector:
          matchLabels:
            app: api-gateway
    ports:
      - protocol: TCP
        port: 8000

Helm Values Configuration

Ingress policy rules can be extended via Helm values:

# values.yaml
networkPolicy:
  enabled: true
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: custom-service
      ports:
        - port: 8000

Testing Ingress Policies

After deploying a new NetworkPolicy, verify connectivity:

# Use platform-status.sh to check service connectivity
./scripts/tools/platform-status.sh

Troubleshooting

Issue	Symptom	Resolution
Service unreachable	Connection timeout from allowed source	Verify pod labels match policy selectors
Prometheus scrape failing	Missing metrics for service	Ensure monitoring namespace label exists
Cross-namespace blocked	Inter-service calls failing	Verify namespace labels and policy selectors
All traffic blocked	Service completely unreachable	Check for default-deny policy without exceptions

Overview Egress Policies