From ae3f16498736ed6ba0733e6656d82cb47d8eb5a6 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Mon, 13 Jul 2026 20:03:29 +0000 Subject: [PATCH] fix(stalwart): Add externalTrafficPolicy: Local to LoadBalancer services Root cause: ArgoCD continuously reverts the LoadBalancer services to use externalTrafficPolicy: Cluster (the k8s default), causing k3s to assign internal flannel VXLAN IPs (10.42.1.x) instead of the node public IPs. With externalTrafficPolicy: Cluster, traffic can be routed to any node, and k3s's service controller assigns the flannel overlay IPs. This breaks external connectivity because those IPs are not routable from outside. With externalTrafficPolicy: Local, traffic is only routed to pods on the same node, and k3s assigns the node's actual public IP to the LoadBalancer. This was the missing piece from the reliability hardening in commit b0f2acf. Without this in git, any manual kubectl patch is reverted by ArgoCD sync. Evidence: stalwart-smtp and stalwart-imap both showing LoadBalancer IPs: 10.42.1.1, 10.42.1.2, 10.42.1.3, 10.42.1.5 (internal flannel IPs) Related: DEV-230, DEV-231, DEV-233, DEV-235 Co-Authored-By: Paperclip --- apps/stalwart/stalwart-fresh-deployment.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml index de86340..8f9dc6f 100644 --- a/apps/stalwart/stalwart-fresh-deployment.yaml +++ b/apps/stalwart/stalwart-fresh-deployment.yaml @@ -24,6 +24,7 @@ metadata: namespace: stalwart spec: type: LoadBalancer + externalTrafficPolicy: Local selector: app: stalwart ports: @@ -47,6 +48,7 @@ metadata: namespace: stalwart spec: type: LoadBalancer + externalTrafficPolicy: Local selector: app: stalwart ports: