a9a53ca31e
All checks were successful
build-images / signing-service image (push) Successful in 26s
build-images / verification-service image (push) Successful in 27s
phase1-smoke / Phase 1 end-to-end smoke (push) Successful in 1m2s
build-images / approval-service image (push) Successful in 27s
build-images / dummy-sink image (push) Successful in 26s
validate / JSON Schema (ajv) (push) Successful in 21s
validate / Rego (opa fmt + opa test) (push) Successful in 15s
validate / DB (migrate up/down dry-run) (push) Successful in 27s
validate / Go (vet + test) (push) Successful in 1m22s
The Phase-1 NetworkPolicy from DEV-614 allowed ingress only from the `pangolin` namespace, under the mistaken assumption that Traefik runs there. In this cluster Traefik lives in `kube-system`; Pangolin only renders the Traefik dynamic config and does not sit in the request path. The policy therefore blocked external calls to `approval.proofedmesh.basicstack.de`, which 502'd at Traefik. Point the ingress rule at `kube-system/app.kubernetes.io/name=traefik` and update the inline comment to match reality. Verified: `curl -sS https://approval.proofedmesh.basicstack.de/healthz` → `{"status":"ok"}` (HTTP 200, LetsEncrypt cert via Traefik ACME). Co-Authored-By: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| approval-service | ||
| dummy-sink | ||
| signing-service | ||
| trillian | ||
| verification-service | ||