Merge pull request #26 from onyx-dot-app/revert-22-jtahara/enforce-strict-networking

Revert "fix(k8s): Locking down networking"

Author: justin-tahara

kubernetes/code-interpreter/templates/networkpolicy.yaml

@@ -19,30 +19,4 @@ spec:
   egress:
     {{- toYaml . | nindent 4 }}
   {{- end }}
----
-# NetworkPolicy for ephemeral executor pods spawned by the code-interpreter.
-# These pods run user-submitted code and must be fully network-isolated
-# to prevent data exfiltration and SSRF attacks.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: {{ include "code-interpreter.fullname" . }}-executor
-  labels:
-    {{- include "code-interpreter.labels" . | nindent 4 }}
-spec:
-  podSelector:
-    matchLabels:
-      app: code-interpreter
-      component: executor
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    # Allow exec connections from the code-interpreter service pod
-    - from:
-        - podSelector:
-            matchLabels:
-              {{- include "code-interpreter.selectorLabels" . | nindent 14 }}
-  egress: []
-  # Deny all egress — executor pods must not have network access
 {{- end }}

kubernetes/code-interpreter/values.yaml

@@ -164,7 +164,7 @@ readinessProbe:
 
 # Network Policy
 networkPolicy:
-  enabled: true
+  enabled: false
   policyTypes:
     - Ingress
     - Egress