From e18308b7505b7dbef5b58cabb5596151217d73dc Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 19:50:29 -0500 Subject: [PATCH] Fix pg-n8n's long-recurring CNPG status-extraction error - missing AuthorizationPolicy rule n8n's allow-n8n-access AuthorizationPolicy only allowed traffic from the n8n/istio-system/prometheus namespaces - unlike nextcloud/authentik's policies, it was missing the broader ipBlocks: 10.244.0.0/16 fallback rule. The CNPG operator (cnpg-system namespace) polling pg-n8n instances' status API (port 8000) wasn't covered by any rule, so Istio's L4 authorization enforcement (via ztunnel - this traffic is direct pod-IP, not routed through a Service, so waypoint/L7 never sees it) rejected the connection outright, surfacing as a TCP reset to the operator. This was the actual cause of pg-n8n's long-recurring 'Instance Status Extraction Error' - confirmed 100% reproducible tonight (every single operator poll attempt failed identically), not the intermittent HBONE-tunnel issue it resembled from the outside. Also labeled the n8n namespace istio.io/use-waypoint=waypoint (was in the enrollment script's namespace list but the label was missing live - namespace parity fix, though not itself the fix for this specific issue since this traffic bypasses the waypoint). Co-Authored-By: Claude Sonnet 5 --- .../manifests/apps/authorization-policies-apps.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml b/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml index 60e3ad0..293b2ca 100644 --- a/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml +++ b/infrastructure/istio/manifests/apps/authorization-policies-apps.yaml @@ -107,6 +107,17 @@ spec: - source: namespaces: - prometheus + # CNPG operator (cnpg-system) polling pg-n8n instances' status API + # (port 8000). Missing here despite being needed for the exact same + # reason as authentik/nextcloud/crowdsec - found 2026-08-17: this was + # the actual cause of pg-n8n's long-recurring "Instance Status + # Extraction Error" (100% reproducible connection resets from + # cnpg-system, not the intermittent HBONE-tunnel issue it looked like + # from the outside). Matches nextcloud's broader ipBlocks fallback. + - from: + - source: + ipBlocks: + - "10.244.0.0/16" --- # --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---