From 7e8fd296c4c0376b2e28372319793a6ccf64aebf Mon Sep 17 00:00:00 2001
From: Hermes DevOps <hermes@devops.local>
Date: Mon, 25 May 2026 07:15:59 +0000
Subject: [PATCH] fix(platform): allow tailscale namespace in NetworkPolicy for
 proxy access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tailscale proxy pods run in the tailscale namespace, so the existing
customer1-only namespaceSelector blocked proxy → dashboard traffic.
---
 .../trading-network-policies.yaml                | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
index d62cada..4213845 100644
--- a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
+++ b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
@@ -33,6 +33,22 @@ spec:
           protocol: TCP
         - port: 8003
           protocol: TCP
+    # Allow from Tailscale proxy namespace
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: tailscale
+      ports:
+        - port: 3000
+          protocol: TCP
+        - port: 8000
+          protocol: TCP
+        - port: 8001
+          protocol: TCP
+        - port: 8002
+          protocol: TCP
+        - port: 8003
+          protocol: TCP
     # Allow inter-service communication
     - from:
         - podSelector: