Let the account site read an existing Authelia sign-in.

The account site forwards the caller's session cookie to Authelia GET /api/state. Allow that one path from the user-engine pods to Authelia port 9091.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

sso-mfa/k8s/network-policies/netpol-sso.yaml

@@ -8,6 +8,7 @@
 # Allowed ingress paths:
 #   Traefik → keycape  :8080   (OIDC endpoints, user-facing)
 #   user-engine → keycape :8080 (OIDC token exchange and discovery)
+#   user-engine → authelia :9091 (read GET /api/state for an existing sign-in)
 #   Traefik → authelia :9091   (login portal, user-facing)
 #   Traefik → lldap    :17170  (admin web UI; IP-restricted at Traefik layer)
 #
@@ -132,6 +133,33 @@ spec:
         - port: 17170
           protocol: TCP
 ---
+# ── user-engine → Authelia :9091 ──────────────────────────────────────────────
+# The account site forwards only the caller's authelia_session cookie to
+# GET /api/state so it can name an existing NetKingdom sign-in. It does not
+# create an account-site session from that answer.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-user-engine-to-authelia
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authelia
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: user-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: user-engine
+      ports:
+        - port: 9091
+          protocol: TCP
+---
 # ── KeyCape → Authelia :9091 ──────────────────────────────────────────────────
 # KeyCape redirects the browser to Authelia and exchanges auth codes at /token.
 apiVersion: networking.k8s.io/v1