[delete-cloud]

Problem

The KB index CronJob (#601) carried the agent selectorLabels, so the agent NetworkPolicy (anti-SSRF default-deny on private ranges) blocked it from cloning the in-cluster git host. Live testing confirmed an extraEgress allow — and even a dedicated NetworkPolicy with 0.0.0.0/0:443 — does not fix it: the CNI does not honor ipBlock egress to in-cluster / node-mesh IPs (public 443 worked; the private/node IP timed out).

Fix

• Relabel the index Job pod (app.kubernetes.io/name: <name>-kb-index, component: kb-index) so it is excluded from the agent NetworkPolicy.
• Run the Job with unrestricted egress, consistent with the existing github→forgejo sync job that already runs unrestricted with the same trust profile. The Job executes a fixed, trusted pipeline (git clone + kb index) with no untrusted tool/LLM execution, so it doesn't need the agent's SSRF egress lockdown.

Tests

tests/deploy: the index-Job test asserts it does not match the agent netpol podSelector. helm lint clean; 44 deploy tests pass.

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

The KB index CronJob pod template labels are changed from the shared agent selectorLabels helper to explicit app.kubernetes.io/* labels, excluding the job from the agent's NetworkPolicy. A new dedicated egress-only NetworkPolicy for the KB index job is added, allowing only DNS and HTTPS traffic. Tests are updated and extended to validate both behaviors.

Changes

KB Index NetworkPolicy Isolation

Layer / File(s)	Summary
CronJob pod labels exclude agent NetworkPolicy selector coding-agent/helm/templates/cronjob-kb-index.yaml	Pod template labels replaced from coding-agent.selectorLabels helper to explicit app.kubernetes.io/name, /instance, and /component labels, with comments documenting intentional exclusion from the agent NetworkPolicy.
Dedicated egress-only NetworkPolicy for KB index job coding-agent/helm/templates/networkpolicy-kb-index.yaml	New template conditionally renders a NetworkPolicy selecting pods labeled app.kubernetes.io/component: <release>-kb-index, with policyTypes: [Egress], optional DNS (UDP/TCP 53), and HTTPS (TCP 443 to 0.0.0.0/0).
Tests: CronJob label exclusion and dedicated NetworkPolicy rules coding-agent/tests/deploy/test_helm_chart.py	Existing test renamed and updated to assert KB index job labels do not satisfy the agent NetworkPolicy podSelector. Two new tests verify dedicated NetworkPolicy renders with correct egress rules when indexing is enabled, and is absent when disabled.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#601: Introduced the KB index CronJob and its initial label/network policy behavior that this PR directly modifies to isolate from the agent NetworkPolicy.

Poem

🐇 A bunny hops past the old labels one day,
"These selectors! They led the index astray!"
A fresh NetworkPolicy, egress-only and neat,
DNS and HTTPS—no extra feat.
The agent stays clean, the index gets its own gate,
One small hop for labels, one leap for the state! 🌐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: excluding the kb-index Job from agent NetworkPolicy through dedicated labeling.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kb-index-netpol

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}