gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-20 23:16:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix pg-n8n's long-recurring CNPG status-extraction error - missing AuthorizationPolicy rule

Browse Source 
n8n's allow-n8n-access AuthorizationPolicy only allowed traffic from the
n8n/istio-system/prometheus namespaces - unlike nextcloud/authentik's
policies, it was missing the broader ipBlocks: 10.244.0.0/16 fallback
rule. The CNPG operator (cnpg-system namespace) polling pg-n8n instances'
status API (port 8000) wasn't covered by any rule, so Istio's L4
authorization enforcement (via ztunnel - this traffic is direct pod-IP,
not routed through a Service, so waypoint/L7 never sees it) rejected the
connection outright, surfacing as a TCP reset to the operator.

This was the actual cause of pg-n8n's long-recurring 'Instance Status
Extraction Error' - confirmed 100% reproducible tonight (every single
operator poll attempt failed identically), not the intermittent
HBONE-tunnel issue it resembled from the outside. Also labeled the n8n
namespace istio.io/use-waypoint=waypoint (was in the enrollment script's
namespace list but the label was missing live - namespace parity fix,
though not itself the fix for this specific issue since this traffic
bypasses the waypoint).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-17 19:50:29 -05:00
co-authored by Claude Sonnet 5
parent 2c8d29c51f
commit e18308b750
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/istio/manifests/apps/authorization-policies-apps.yaml
+11
View File
@@ -107,6 +107,17 @@ spec:
- source: - source:
namespaces: namespaces:
- prometheus - prometheus
# CNPG operator (cnpg-system) polling pg-n8n instances' status API
# (port 8000). Missing here despite being needed for the exact same
# reason as authentik/nextcloud/crowdsec - found 2026-08-17: this was
# the actual cause of pg-n8n's long-recurring "Instance Status
# Extraction Error" (100% reproducible connection resets from
# cnpg-system, not the intermittent HBONE-tunnel issue it looked like
# from the outside). Matches nextcloud's broader ipBlocks fallback.
- from:
- source:
ipBlocks:
- "10.244.0.0/16"
--- ---
# --- Nextcloud: Allow ingress + Prometheus + intra-namespace --- # --- Nextcloud: Allow ingress + Prometheus + intra-namespace ---