From 79faafe40ab94d1a573148a4ef763cc22412a071 Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Sun, 23 Aug 2026 18:21:54 +0200
Subject: [PATCH] openclaw: allow traefik namespace

---
 kubernetes/personal/openclaw/openclaw-instance.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kubernetes/personal/openclaw/openclaw-instance.yaml b/kubernetes/personal/openclaw/openclaw-instance.yaml
index facac0f..a7fc28b 100644
--- a/kubernetes/personal/openclaw/openclaw-instance.yaml
+++ b/kubernetes/personal/openclaw/openclaw-instance.yaml
@@ -26,6 +26,11 @@ spec:
         forceHTTPS: false
       annotations:
         external-dns.alpha.kubernetes.io/enabled: "true"
+  # Operator's default-deny NetworkPolicy only allows same-namespace ingress;
+  # allow Traefik so the Ingress route can reach the gateway proxy.
+  networkPolicy:
+    allowedIngressNamespaces:
+      - traefik
   resources:
     requests:
       cpu: 250m