fix(#196): allow training-pod egress to the requests-proxy (8888)

[saadqbal]

Summary

The training-egress NetworkPolicy blocks training pods from reaching requests-proxy-service:8888, so every experiment fails: pods can't POST epoch results → Connection refused → CrashLoopBackOff. Adds the missing egress rule.

Root cause

templates/network-policy-training.yaml denies all pod-to-pod / ClusterIP egress (rule 2 excepts the cluster CIDRs) and re-permits only MySQL (rule 3). The requests-proxy architecture — pods POST to the proxy on 8888 instead of holding Service Bus creds — shipped without a matching egress allow-rule here. The proxy, the entire intended egress path, was blocked.

Fix

Rule 4, mirroring the MySQL rule: TCP/8888 → podSelector app=requests-proxy (same namespace). Matches templates/requests-proxy-service.yaml (selector app=requests-proxy, port 8888).

Verification

• helm template -f ci/bm-values.yaml --show-only templates/network-policy-training.yaml renders the rule as valid YAML.
• Found live on a fresh client (tracebloc-amazon, k3d): jobs-manager reached the proxy (HTTP 401) while training pods got connection-refused — the only differentiator was this egress policy. Live-patched + verified the affected cluster (training-labeled probe connects; pods now progress past epoch 0; jobs completing).

Deployment note

The affected cluster's auto-upgrade CronJob is suspended so its helm upgrade --reuse-values doesn't revert the interim live patch. Once this is released, re-enable it and the cluster self-heals onto the chart-managed rule.

Closes#196.

🤖 Generated with Claude Code

---

Note

Low Risk
Single-port, in-namespace egress exception matching the existing MySQL pattern; no broadening of external or cross-namespace access.

Overview
Adds egress rule 4 to the training NetworkPolicy so pods labeled tracebloc.io/workload=training can reach the in-namespace requests-proxy on TCP 8888, using the same podSelector pattern as the existing MySQL allow.

Rule 2 only permits HTTPS to addresses outside the cluster CIDRs, which blocks ClusterIP traffic to requests-proxy-service. Training jobs POST epoch results through that proxy instead of holding Service Bus credentials; without this exception they fail at epoch finalize with connection refused and CrashLoopBackOff (#196).

^{Reviewed by Cursor Bugbot for commit e8d4f2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 14 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#102 — chore(kanban): declare staging as prod-truth branch via .kanban.yml · author: @LukasWodka · no reviewer assigned
• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client#192 — Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version · author: @LukasWodka · no reviewer assigned
• client-runtime#79 — docs(chore: real merge commit to unblock PR #57 #59): feasibility — delete pod_tokens (and the reconciler)? · author: @saadqbal · no reviewer assigned
• data-ingestors#146 — test(schema): lock category enum to the engine's TaskCategory (anti-drift) · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#148 — Develop to prod · author: @divyasinghds · reviewer: @saadqbal
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• design-system#22 — ci: add Vitest test workflow · author: @LukasWodka · reviewer: @aptracebloc
• design-system#23 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• docs#47 — docs(environment-setup): Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192 namespace/workspace flow (hold for client#192) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)