---
# Istio ambient mesh routes ALL pod-to-pod traffic through ztunnel's HBONE
# tunnel on port 15008, not the application's own port - the app-port-only
# NetworkPolicies the argo-cd chart renders by default (e.g. argocd-redis
# only allowing port 6379) block the actual HBONE connection even though the
# "real" port is allowed, because ztunnel's encrypted tunnel itself never
# gets past the policy. Symptom: every inter-pod connection in the argocd
# namespace hangs for exactly 10s then resets - ztunnel logs the reason
# directly: "connection timed out, maybe a NetworkPolicy is blocking HBONE
# port 15008". Confirmed 2026-08-17: this was breaking argocd-server's
# Redis-backed session/cluster-info caching cluster-wide.
#
# NetworkPolicies are additive (union of all policies selecting a pod), so
# this supplements the chart's rendered policies rather than replacing them -
# safe across Helm upgrades.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-allow-hbone
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: argocd
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector: {}
      ports:
        - protocol: TCP
          port: 15008