gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 11:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Widen mTLS PERMISSIVE/AuthorizationPolicy to cover port 61432 too

Browse Source 
home's own authentik pods reach ha-authentik-postgres via the CoreDNS
rewrite on port 61432 (not just external traffic via NodePort on 5432/
61432) - discovered live that Istio ambient's port-level mTLS/L4
authorization enforcement is keyed on the port actually dialed (61432
here), not just the pod's real containerPort (5432) traffic eventually
reaches after Service translation. The existing port-5432-only rules
(from the streaming-replication fix) didn't cover this in-cluster path,
surfacing as 'server closed the connection unexpectedly' from home's own
authentik-worker pod.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-20 18:51:42 -05:00
co-authored by Claude Sonnet 5
parent 185e9c292e
commit c6d4294be6
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/istio/manifests/mesh/authorization-policies.yaml
+1
View File
@@ -131,6 +131,7 @@ spec:
- operation:
ports:
- "5432"
- "61432" # floating-hostname port, see ha-postgres-peerauth.yaml
---
# --- Grafana: Allow ingress + Prometheus datasource queries + scraping ---