basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(stalwart): Add externalTrafficPolicy: Local to LoadBalancer services

Browse source 
Root cause: ArgoCD continuously reverts the LoadBalancer services to use
externalTrafficPolicy: Cluster (the k8s default), causing k3s to assign
internal flannel VXLAN IPs (10.42.1.x) instead of the node public IPs.

With externalTrafficPolicy: Cluster, traffic can be routed to any node,
and k3s's service controller assigns the flannel overlay IPs. This breaks
external connectivity because those IPs are not routable from outside.

With externalTrafficPolicy: Local, traffic is only routed to pods on the
same node, and k3s assigns the node's actual public IP to the LoadBalancer.

This was the missing piece from the reliability hardening in commit b0f2acf.
Without this in git, any manual kubectl patch is reverted by ArgoCD sync.

Evidence: stalwart-smtp and stalwart-imap both showing LoadBalancer IPs:
10.42.1.1, 10.42.1.2, 10.42.1.3, 10.42.1.5 (internal flannel IPs)

Related: DEV-230, DEV-231, DEV-233, DEV-235

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-07-13 20:03:29 +00:00
parent c755bc1a45
commit ae3f164987
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apps/stalwart/stalwart-fresh-deployment.yaml
View file

@ -24,6 +24,7 @@ metadata:
namespace: stalwart
spec:
type: LoadBalancer
externalTrafficPolicy: Local
selector:
app: stalwart
ports:
@ -47,6 +48,7 @@ metadata:
namespace: stalwart
spec:
type: LoadBalancer
externalTrafficPolicy: Local
selector:
app: stalwart
ports: