fix: Add missing NetworkPolicy egress rules for pdf-extraction-service

- Add MinIO:9000 access for storing extracted images, JSON, and job results
- Add Redis:6379 access for document file list management
- Remove incorrect comment about "no internal service dependencies"
- Update README service communication matrix to include pdf-extraction-service
- Fix NetworkPolicy that would have blocked essential MinIO and Redis access
- Based on source code analysis: service uses S3Utils and RedisDocumentFileList

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: NotYuSheng

README.md

@@ -140,11 +140,12 @@ OmniPDF implements comprehensive zero-trust network policies with explicit servi
 | **pdf-processor-service** | • nginx<br>• frontend | • chat-service:8000<br>• pdf-extraction-service:8000<br>• embedder-service:8000<br>• docling-translation-service:8000<br>• pdf-renderer-service:8000<br>• image-captioner-service:8000<br>• metadata-service:8000<br>• minio:9000<br>• redis:6379<br>• DNS resolution |
 | **chat-service** | • pdf-processor-service | • chromadb:8000<br>• DNS resolution<br>• HTTPS (external vLLM) |
 | **embedder-service** | • pdf-processor-service | • chromadb:8000<br>• DNS resolution<br>• HTTPS (model downloads) |
+| **pdf-extraction-service** | • pdf-processor-service | • minio:9000<br>• redis:6379<br>• DNS resolution<br>• HTTPS (docling model downloads) |
 | **metadata-service** | • pdf-processor-service | • chromadb:8000<br>• minio:9000<br>• redis:6379<br>• DNS resolution<br>• HTTPS (external vLLM) |
 | **cleaner** | *No ingress (background service)* | • minio:9000<br>• chromadb:8000<br>• redis:6379<br>• DNS resolution |
 | **chromadb** | • chat-service<br>• embedder-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
-| **redis** | • pdf-processor-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
-| **minio** | • pdf-processor-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
+| **redis** | • pdf-processor-service<br>• pdf-extraction-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
+| **minio** | • pdf-processor-service<br>• pdf-extraction-service<br>• metadata-service<br>• cleaner | • DNS resolution<br>*No outbound calls* |
 
 #### Network Policy Configuration
 

helm/pdf-extraction-service/values.yaml

@@ -165,8 +165,20 @@ networkPolicy:
     allowHTTPS: true
     # Allow HTTP for internal services  
     allowHTTP: false
-    # ZERO-TRUST: pdf-extraction-service only needs external model access
-    allowedTargets: []  # No internal service dependencies
+    # ZERO-TRUST: pdf-extraction-service can only call specific services
+    allowedTargets:
+      # MinIO for storing extracted images, JSON, and job results
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: minio
+        ports:
+          - 9000
+      # Redis for document file list management
+      - podSelector:
+          matchLabels:
+            app.kubernetes.io/name: redis
+        ports:
+          - 6379
     # Custom egress rules (empty by default)
     customRules: []