From a9a53ca31ec79e599f031c7282b2392349d8f0d17c8733024730f5c9ea4622ff Mon Sep 17 00:00:00 2001 From: "CTO (Paperclip)" Date: Sun, 25 Oct 2026 21:23:59 +0000 Subject: [PATCH] approval-service: fix NetworkPolicy ingress to allow Traefik from kube-system (DEV-619) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Phase-1 NetworkPolicy from DEV-614 allowed ingress only from the `pangolin` namespace, under the mistaken assumption that Traefik runs there. In this cluster Traefik lives in `kube-system`; Pangolin only renders the Traefik dynamic config and does not sit in the request path. The policy therefore blocked external calls to `approval.proofedmesh.basicstack.de`, which 502'd at Traefik. Point the ingress rule at `kube-system/app.kubernetes.io/name=traefik` and update the inline comment to match reality. Verified: `curl -sS https://approval.proofedmesh.basicstack.de/healthz` → `{"status":"ok"}` (HTTP 200, LetsEncrypt cert via Traefik ACME). Co-Authored-By: Paperclip --- deploy/approval-service/40-networkpolicy.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/deploy/approval-service/40-networkpolicy.yaml b/deploy/approval-service/40-networkpolicy.yaml index 74b12ab..88b3638 100644 --- a/deploy/approval-service/40-networkpolicy.yaml +++ b/deploy/approval-service/40-networkpolicy.yaml @@ -27,13 +27,18 @@ spec: - Ingress - Egress ingress: - # Public traffic reaches approval-service only via the Pangolin edge - # (Traefik lives inside the Pangolin namespace). Keep this list - # conservative — add additional callers on demand, not speculatively. + # Public traffic reaches approval-service via the Pangolin resource, + # but the actual TCP connection is made by the Traefik ingress pod + # in kube-system (Pangolin only renders the Traefik config; it does + # not sit in the request path). Keep this list conservative — add + # additional callers on demand, not speculatively. - from: - namespaceSelector: matchLabels: - kubernetes.io/metadata.name: pangolin + kubernetes.io/metadata.name: kube-system + podSelector: + matchLabels: + app.kubernetes.io/name: traefik ports: - port: 8080 protocol: TCP