From bb170365ccb183bf6a427ceacc5c0151c7c75749 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@sirius0xdev.com>
Date: Wed, 27 May 2026 14:19:26 +0000
Subject: [PATCH] fix: network policy Kafka selector app -> strimzi labels

Data-service pods use NetworkPolicy egress selector app: trading-kafka
but Strimzi Kafka pods are labeled strimzi.io/name=trading-kafka.
This silently blocked all Kafka traffic causing NoBrokersAvailable.
---
 .../network-policies/trading-network-policies.yaml   | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
index dade3c9..53614a3 100644
--- a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
+++ b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
@@ -99,11 +99,19 @@ spec:
       ports:
         - port: 6379
           protocol: TCP
-    # Allow Kafka access
+    # Allow Kafka access (Strimzi labels)
     - to:
         - podSelector:
             matchLabels:
-              app: trading-kafka
+              strimzi.io/name: trading-kafka
+      ports:
+        - port: 9092
+          protocol: TCP
+    # Allow Kafka bootstrap service (fallback)
+    - to:
+        - podSelector:
+            matchLabels:
+              strimzi.io/cluster: trading-kafka
       ports:
         - port: 9092
           protocol: TCP