From a277ca793dae8539dcd34be4b0593331ca61689b Mon Sep 17 00:00:00 2001 From: Attila Laszlo Nagy Date: Fri, 24 Jul 2026 11:03:58 +0200 Subject: [PATCH] Helm: Admit labeled harness MCP clients Allow the sie-gw-cfg Synty endpoint to accept callers only when both the sie-harness namespace and MCP-client pod label match. Helm rendering confirms the new peer remains constrained by 2 selectors. --- README.md | 4 +++- deploy/helm/synty/values-sie-gw-cfg.yaml | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2e2bc9f..349dbf9 100644 --- a/README.md +++ b/README.md @@ -267,7 +267,9 @@ CIDR configuration is capped at 64 ranges and rejects IPv4 prefixes broader than `/12` or IPv6 prefixes broader than `/32`, including split-default-route combinations. The Service remains cluster-internal, and its default ingress accepts only same-namespace pods labeled -`synty.superlinked.com/mcp-client: "true"`. +`synty.superlinked.com/mcp-client: "true"`. The `sie-gw-cfg` values additionally +admit that label from the `sie-harness` namespace; both selectors must match, so +other namespaces and unlabeled harness pods remain denied. Size persistent storage for the raw corpus plus both the current and staged immutable build. Chart-created PVCs carry Helm's `keep` policy so an upgrade cannot discard the corpus; use `persistence.existingClaim` when a cluster's diff --git a/deploy/helm/synty/values-sie-gw-cfg.yaml b/deploy/helm/synty/values-sie-gw-cfg.yaml index 185aded..86f66f4 100644 --- a/deploy/helm/synty/values-sie-gw-cfg.yaml +++ b/deploy/helm/synty/values-sie-gw-cfg.yaml @@ -46,6 +46,12 @@ networkPolicy: - podSelector: matchLabels: synty.superlinked.com/mcp-client: "true" + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: sie-harness + podSelector: + matchLabels: + synty.superlinked.com/mcp-client: "true" # AWS's published S3 prefixes for us-west-2. Refresh from ip-ranges.json when # AWS announces a range change; the MCP pod otherwise fails closed. objectStoreCidrs: