Duc NguyenandClaude Opus 5
1505471bc7
Each tenant namespace carries two NetworkPolicies created by KubePlus:
restrict-cross-ns-traffic podSelector {} same-namespace only
allow-external-traffic podSelector partof=<release> allow all
Without the partof label only the first applies, so the ingress controller - which
lives in another namespace - is blocked and every request to the tenant returns 502
from nginx while Label Studio itself is perfectly healthy.
That label was only ever applied by the KubePlus mutating webhook at pod creation
time, and that webhook runs with failurePolicy: Ignore. When the webhook is broken,
pods are still admitted, just without the label, and the tenant goes dark silently.
Every pod recreated during such a window loses external access.
Set it in the pod template instead so it no longer depends on the webhook. The Helm
release name is exactly the value the policy expects (labelstudioservice-<namespace>).
The selector is left untouched, so this stays a valid in-place upgrade.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>