fix: Add missing NetworkPolicy egress rules for metadata-service

- Add ChromaDB:8000 access for retrieving document chunks
- Add MinIO:9000 access for storing/loading job results
- Add Redis:6379 access for document file list management
- Update README service communication matrix to include metadata-service
- Fix incomplete NetworkPolicy that would have blocked service communication
- Resolves issue identified by code analysis of actual service dependencies

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: NotYuSheng

README.md

@@ -140,10 +140,11 @@ OmniPDF implements comprehensive zero-trust network policies with explicit servi
 | **pdf-processor-service** | • nginx<br>• frontend | • chat-service:8000<br>• pdf-extraction-service:8000<br>• embedder-service:8000<br>• docling-translation-service:8000<br>• pdf-renderer-service:8000<br>• image-captioner-service:8000<br>• metadata-service:8000<br>• minio:9000<br>• redis:6379<br>• DNS resolution |
 | **chat-service** | • pdf-processor-service | • chromadb:8000<br>• DNS resolution<br>• HTTPS (external vLLM) |
 | **embedder-service** | • pdf-processor-service | • chromadb:8000<br>• DNS resolution<br>• HTTPS (model downloads) |
+| **metadata-service** | • pdf-processor-service | • chromadb:8000<br>• minio:9000<br>• redis:6379<br>• DNS resolution<br>• HTTPS (external vLLM) |
 | **cleaner** | *No ingress (background service)* | • minio:9000<br>• chromadb:8000<br>• redis:6379<br>• DNS resolution |
-| **chromadb** | • chat-service<br>• embedder-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
-| **redis** | • pdf-processor-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
-| **minio** | • pdf-processor-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
+| **chromadb** | • chat-service<br>• embedder-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
+| **redis** | • pdf-processor-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
+| **minio** | • pdf-processor-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
 
 #### Network Policy Configuration
 

helm/metadata-service/values.yaml

@@ -206,7 +206,25 @@ networkPolicy:
     allowDNS: true
     allowHTTPS: true  # For external vLLM in prestaging
     # ZERO-TRUST: metadata-service can only call specific services
-    allowedTargets: []  # Configured via customRules for external vLLM
+    allowedTargets:
+      # ChromaDB for retrieving document chunks
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: chromadb
+        ports:
+          - 8000
+      # MinIO for storing/loading job results
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: minio
+        ports:
+          - 9000
+      # Redis for document file list management
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: redis
+        ports:
+          - 6379
     # Custom egress rules for special cases (external vLLM, etc.)
     customRules: []