[holmboe]

Problem

Dynatron runs one instance per git worktree in the shared k3d cluster: namespace dynatron
for the main checkout, and dynatron-<slug> for each worktree. phorge-from-dev-apps selected
kubernetes.io/metadata.name: dynatron, so only the main checkout could reach Phorge at
http://web.phorge.svc.cluster.local/api/. Every worktree instance timed out. It also admitted
every pod in that namespace, including Postgres, Valkey and the object store, although only the
hub and the worker call Conduit.

Change

• k8s/base/networkpolicy.yaml: phorge-from-dev-apps has one from entry, and both
  selectors in it must match:

  • namespaceSelector app.kubernetes.io/part-of: dynatron, which every Dynatron instance
    carries, main or worktree
  • podSelector app.kubernetes.io/name In [dynatron, worker], the hub and the worker

  The podSelector on Phorge and port 80 are unchanged. The comment states the trade-off. A
  namespace label is only as trustworthy as whoever may edit namespaces. The pod selector
  narrows the grant, but anyone who can create pods in an admitted namespace can still give a pod
  an admitted name. In a local dev cluster those are the people who could edit the policy anyway.
  A production cluster would have to restrict who labels namespaces first.

• dynamist.se/dev-app is no longer part of the policy. It stays the label dev apps are
  discovered by, in make destroy, the k8s workflow and the isolation test.

• tests/k8s/test_isolation.py: probe_from takes pod labels. The probes from default and
  the other dev apps' namespaces now expect an unlabelled pod to be refused on all three ports.
  New tests run in a scratch namespace labelled app.kubernetes.io/part-of: dynatron and check:

  • pods named dynatron and worker are admitted
  • a pod named postgres is refused

  The scratch namespace means the tests need no Dynatron deployed beside Phorge, which is the
  case in CI.

• docs/phorge-setup.md (the Phorge and in-cluster clients bullets) and CHANGELOG.md
  describe the new policy and its caveat.

Rollout: Dynatron already labels its namespaces app.kubernetes.io/part-of: dynatron alongside
dynamist.se/dev-app: dynatron, so this can merge without waiting on Dynatron.

Checks

• make validate: both overlays valid, 17 resources each
• uv run ruff check, ruff format, uv run mypy: clean
• uv run pytest: 6416 passed
• The new isolation tests run in CI's Deploy and test Phorge stable in k3d (the PR is
  labelled ci:k8s)

This revision was not applied to the shared local cluster by hand. Before the revision, an
earlier version that selected only on the namespace label was checked live. Pods in dynatron,
dynatron-test-reports and dynatron-handle-warnings reached conduit.ping, and pods in
default, noodle and an unlabelled scratch namespace were refused.

🤖 Generated with Claude Code