Marketplace: private same-Space access to qdrant/chromadb appears blocked by Space NetworkPolicies — verify #196

Context

While diagnosing the marketplace networking model we noticed qdrant.go and chromadb.go create no per-app NetworkPolicy, on the assumption that the Space-wide allow-traefik-ingress policy covers them ("HTTP kinds keep using the existing namespace-wide policy").

That policy admits ingress only from Traefik pods in kube-system. The Space-wide default-deny blocks everything else.

Suspicion

A sibling app in the same Space connecting to a private qdrant/chromadb install via its ClusterIP Service (<app>-qdrant.<ns>.svc.cluster.local) is not Traefik → the ingress to the qdrant/chromadb pod is denied by default-deny. The postgres deployer solved exactly this with a scoped per-app netpol (postgres.go ensureNetworkPolicy, same-namespace pods + ssh-gateway). The 2026-09-16 incident confirmed kube-router enforces these policies.

Not verified in-cluster yet — this issue is for triage, not a confirmed bug.

Steps to verify

1. Install qdrant privately in a Space.
2. kubectl exec (or an app pod) a sibling pod in the same namespace and try a TCP connect to <app>-qdrant.<ns>.svc.cluster.local:6333.
3. Expected today per the netpol posture: timeout/refused despite the Service existing.

Proposed fix (if confirmed)

Add a scoped per-app NetworkPolicy to both deployers, mirroring the postgres pattern: ingress on 6333/6334 (qdrant) and 8000 (chromadb) from same-namespace pods only. Do NOT widen to allow-anywhere.