fix(manifests): Allow same-namespace access to SeaweedFS for standalone deployments

[hbelmiro]

Description of your changes:

The SeaweedFS NetworkPolicy only allows traffic from namespaces labeled app.kubernetes.io/part-of: kubeflow-profile or from istio-system. This blocks the API server (running in the kubeflow namespace) from accessing object storage on clusters with NetworkPolicy enforcement, breaking standalone KFP deployments.

Fix: Add an ingress rule allowing same-namespace pod traffic to SeaweedFS on port 8333.

Note: This change aligns with the upstream Kubeflow manifests repository, which deploys a default-allow-same-namespace.yaml NetworkPolicy for the kubeflow namespace. For standalone KFP, we achieve the same functional result by adding the rule directly to the SeaweedFS policy rather than introducing a separate blanket policy. This keeps the standalone deployment simpler while solving the connectivity issue.

Changes

• Added same-namespace ingress rule to SeaweedFS NetworkPolicy
• Fixes standalone deployments by allowing API server and UI to access object storage

Checklist:

• You have signed off your commits
• The title for your pull request (PR) should follow our title convention. Learn more about the pull request title convention used in this repository.

[hbelmiro]

/retest

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from hbelmiro and additionally assign juliusvonkohout for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• .github/OWNERS
• manifests/kustomize/third-party/seaweedfs/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hbelmiro]

@juliusvonkohout can you PTAL on this?

[juliusvonkohout]

Thank you @hbelmiro it looks good and and more robust than before, but may you raise the same PR against kubeflow/manifests to also test the CI/CD there? If it is green and you see a kfp tests, then both are good to merge.

[juliusvonkohout]

kubeflow/manifests#3306 is merged so
/lgtm

and thank you for making it more robust

[juliusvonkohout]

Just be careful if more than this single port is needed in the future for the same namespace. But that can also be adjusted in the future if needed.

[hbelmiro]

@HumairAK can you please take a final look?