From c6d4294be65f0e52d6b4eb725a1c26f763c084b6 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Thu, 20 Aug 2026 18:51:42 -0500 Subject: [PATCH] Widen mTLS PERMISSIVE/AuthorizationPolicy to cover port 61432 too home's own authentik pods reach ha-authentik-postgres via the CoreDNS rewrite on port 61432 (not just external traffic via NodePort on 5432/ 61432) - discovered live that Istio ambient's port-level mTLS/L4 authorization enforcement is keyed on the port actually dialed (61432 here), not just the pod's real containerPort (5432) traffic eventually reaches after Service translation. The existing port-5432-only rules (from the streaming-replication fix) didn't cover this in-cluster path, surfacing as 'server closed the connection unexpectedly' from home's own authentik-worker pod. Co-Authored-By: Claude Sonnet 5 --- .../authentik/manifests/ha-postgres-peerauth.yaml | 11 +++++++++++ .../istio/manifests/mesh/authorization-policies.yaml | 1 + 2 files changed, 12 insertions(+) diff --git a/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml b/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml index f270b1e..f9dd8e0 100644 --- a/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml +++ b/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml @@ -38,3 +38,14 @@ spec: portLevelMtls: "5432": mode: PERMISSIVE + # Multi-site active failover pilot, floating hostname (see + # infrastructure/authentik/manifests/ha-postgres-nodeport.yaml): the + # ha-authentik-postgres Service also listens on 61432 (-> targetPort + # 5432, same pods) so home's own pods can reach it via the + # pg-authentik.ha.huskypup.net CoreDNS rewrite on the same port the + # app tier is configured with externally. Needed its own PERMISSIVE + # entry - confirmed live 2026-08-20 that ambient's port-level mTLS + # enforcement is keyed on the port actually dialed (61432), not just + # the pod's real containerPort (5432) it eventually reaches. + "61432": + mode: PERMISSIVE diff --git a/infrastructure/istio/manifests/mesh/authorization-policies.yaml b/infrastructure/istio/manifests/mesh/authorization-policies.yaml index c025e06..49a4149 100644 --- a/infrastructure/istio/manifests/mesh/authorization-policies.yaml +++ b/infrastructure/istio/manifests/mesh/authorization-policies.yaml @@ -131,6 +131,7 @@ spec: - operation: ports: - "5432" + - "61432" # floating-hostname port, see ha-postgres-peerauth.yaml --- # --- Grafana: Allow ingress + Prometheus datasource queries + scraping ---