mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
bbb80687ca
allow-netbird-operator-access (AuthorizationPolicy) and the netbird-operator PeerAuthentication both targeted namespace 'netbird-operator', which has never existed - the actual netbird-operator pod runs in the 'netbird' namespace. This permanently blocked istio-mesh-config from going Synced (kubectl apply failed: namespaces "netbird-operator" not found on every sync attempt). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
# PeerAuthentication PERMISSIVE for namespaces that receive non-mesh traffic
|
|
# The API server calls webhooks from outside the mesh (no SPIFFE identity).
|
|
# The CrowdSec firewall bouncer runs on hostNetwork (no mesh identity)
|
|
# and must connect to LAPI over plaintext.
|
|
# PERMISSIVE allows both mTLS and plaintext inbound.
|
|
---
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-apiserver-webhooks
|
|
namespace: cnpg-system
|
|
spec:
|
|
mtls:
|
|
mode: PERMISSIVE
|
|
---
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-apiserver-webhooks
|
|
namespace: mariadb-system
|
|
spec:
|
|
mtls:
|
|
mode: PERMISSIVE
|
|
---
|
|
# Netbird operator webhook receives calls from the API server
|
|
# (namespace is "netbird", not "netbird-operator" - that namespace
|
|
# doesn't exist; fixed 2026-08-17)
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-apiserver-webhooks
|
|
namespace: netbird
|
|
spec:
|
|
mtls:
|
|
mode: PERMISSIVE
|
|
---
|
|
# CrowdSec firewall bouncer (hostNetwork DaemonSet) connects to LAPI
|
|
# from the host network namespace without a mesh identity
|
|
apiVersion: security.istio.io/v1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: allow-hostnetwork-bouncer
|
|
namespace: crowdsec
|
|
spec:
|
|
mtls:
|
|
mode: PERMISSIVE
|