mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
c6d4294be6
home's own authentik pods reach ha-authentik-postgres via the CoreDNS rewrite on port 61432 (not just external traffic via NodePort on 5432/ 61432) - discovered live that Istio ambient's port-level mTLS/L4 authorization enforcement is keyed on the port actually dialed (61432 here), not just the pod's real containerPort (5432) traffic eventually reaches after Service translation. The existing port-5432-only rules (from the streaming-replication fix) didn't cover this in-cluster path, surfacing as 'server closed the connection unexpectedly' from home's own authentik-worker pod. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
52 lines
2.6 KiB
YAML
52 lines
2.6 KiB
YAML
# Multi-site active failover pilot (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - CNPG streaming
|
|
# replication from the VPS was silently failing: `pg_stat_wal_receiver` on
|
|
# the VPS replica showed 0 rows, and its logs showed a repeating
|
|
# "could not connect to the primary server: ... server closed the
|
|
# connection unexpectedly" every few minutes (confirmed live 2026-08-19).
|
|
#
|
|
# Root cause: the `authentik` namespace is enrolled in Istio's ambient mesh
|
|
# (`istio.io/dataplane-mode: ambient`) and the mesh-wide default
|
|
# PeerAuthentication (istio-system/default) is STRICT - ztunnel requires a
|
|
# valid mesh (HBONE/SPIFHE) identity for ALL traffic to pods in this
|
|
# namespace, including traffic arriving via the ha-authentik-postgres
|
|
# NodePort from the VPS/witness (which have no mesh identity at all -
|
|
# they're not in this cluster). ztunnel accepts the raw TCP connection then
|
|
# resets it once it can't complete an mTLS handshake it never receives -
|
|
# exactly matching the "server closed the connection unexpectedly"
|
|
# symptom. Confirmed via `openssl s_client -starttls postgres`: TCP
|
|
# connects, the postgres SSLRequest byte is sent, 0 bytes come back.
|
|
#
|
|
# Same root cause and same fix as the existing precedent for this exact
|
|
# problem (infrastructure/istio/manifests/mesh/peer-authentication-webhooks.yaml
|
|
# - CrowdSec's hostNetwork bouncer / the API server's webhook calls): allow
|
|
# PERMISSIVE (mTLS or plaintext) inbound. Scoped here to just the CNPG
|
|
# primary pod's port 5432 via portLevelMtls, rather than the whole
|
|
# namespace like that precedent does - Authentik's own in-mesh east-west
|
|
# traffic (server/worker -> everything else) should stay STRICT.
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-ha-postgres-replication
|
|
namespace: authentik
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
cnpg.io/cluster: pg-authentik
|
|
mtls:
|
|
mode: STRICT
|
|
portLevelMtls:
|
|
"5432":
|
|
mode: PERMISSIVE
|
|
# Multi-site active failover pilot, floating hostname (see
|
|
# infrastructure/authentik/manifests/ha-postgres-nodeport.yaml): the
|
|
# ha-authentik-postgres Service also listens on 61432 (-> targetPort
|
|
# 5432, same pods) so home's own pods can reach it via the
|
|
# pg-authentik.ha.huskypup.net CoreDNS rewrite on the same port the
|
|
# app tier is configured with externally. Needed its own PERMISSIVE
|
|
# entry - confirmed live 2026-08-20 that ambient's port-level mTLS
|
|
# enforcement is keyed on the port actually dialed (61432), not just
|
|
# the pod's real containerPort (5432) it eventually reaches.
|
|
"61432":
|
|
mode: PERMISSIVE
|