From 2824d71bb71fa5efec4e460e2994db73ec961576 Mon Sep 17 00:00:00 2001
From: biersoeckli <meow@biersoeckli.ch>
Date: Thu, 27 Aug 2026 10:23:30 +0000
Subject: [PATCH] feat: Enhance network policy to allow ingress from the
 quickstack namespace

---
 src/server/services/network-policy.service.ts           | 5 +++++
 src/server/services/network-policy.service.unit.spec.ts | 7 ++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/server/services/network-policy.service.ts b/src/server/services/network-policy.service.ts
index 449c5fd3..b69b1cd1 100644
--- a/src/server/services/network-policy.service.ts
+++ b/src/server/services/network-policy.service.ts
@@ -165,6 +165,11 @@ class NetworkPolicyService {
         return {
             ingress: [{
                 from: [{
+                    namespaceSelector: {
+                        matchLabels: {
+                            'kubernetes.io/metadata.name': Constants.QS_NAMESPACE,
+                        },
+                    },
                     podSelector: {
                         matchLabels: {
                             app: QS_AUTH_PROXY_SERVICE_NAME,
diff --git a/src/server/services/network-policy.service.unit.spec.ts b/src/server/services/network-policy.service.unit.spec.ts
index 136a9269..cf2ed8db 100644
--- a/src/server/services/network-policy.service.unit.spec.ts
+++ b/src/server/services/network-policy.service.unit.spec.ts
@@ -59,7 +59,7 @@ describe('network-policy.service', () => {
         );
     });
 
-    it('allows ingress from auth proxy to all sandbox ports', () => {
+    it('allows auth proxy ingress from the quickstack namespace to all sandbox ports', () => {
         const policy = networkPolicyService.buildAgentSandboxTemplateNetworkPolicy({
             allowInternetAccess: false,
             rules: [],
@@ -67,6 +67,11 @@ describe('network-policy.service', () => {
 
         expect(policy?.ingress).toEqual([{
             from: [{
+                namespaceSelector: {
+                    matchLabels: {
+                        'kubernetes.io/metadata.name': 'quickstack',
+                    },
+                },
                 podSelector: {
                     matchLabels: {
                         app: 'qs-auth-proxy',