Scooby HuskyandClaude Sonnet 5 c6d4294be6 Widen mTLS PERMISSIVE/AuthorizationPolicy to cover port 61432 too ...

home's own authentik pods reach ha-authentik-postgres via the CoreDNS
rewrite on port 61432 (not just external traffic via NodePort on 5432/
61432) - discovered live that Istio ambient's port-level mTLS/L4
authorization enforcement is keyed on the port actually dialed (61432
here), not just the pod's real containerPort (5432) traffic eventually
reaches after Service translation. The existing port-5432-only rules
(from the streaming-replication fix) didn't cover this in-cluster path,
surfacing as 'server closed the connection unexpectedly' from home's own
authentik-worker pod.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-20 18:51:42 -05:00

..

authentik-allow.yaml

Add ServiceEntry for wildcard host to fix Kiali KIA0104

2026-03-10 22:35:20 -05:00

authorization-policies.yaml

Widen mTLS PERMISSIVE/AuthorizationPolicy to cover port 61432 too

2026-08-20 18:51:42 -05:00

ext-authz-policies.yaml

Remove nessus from cluster configuration

2026-03-10 21:02:45 -05:00

hook-sa.yaml

Add argocd-hook-sa ServiceAccount to app namespaces

2026-03-10 17:51:04 -05:00

monitoring.yaml

Fix ztunnel PodMonitor port name to match actual container port

2026-03-10 20:03:03 -05:00

namespace-enrollment-job.yaml

Switch hook jobs from bitnami/kubectl to alpine/k8s:1.32.13

2026-03-10 18:08:22 -05:00

peer-authentication-webhooks.yaml

Fix netbird-operator namespace reference in istio mesh policies

2026-08-17 18:20:00 -05:00

peer-authentication.yaml

Initial commit

2026-03-09 20:21:35 -05:00

waypoint-gateways.yaml

Remove nessus from cluster configuration

2026-03-10 21:02:45 -05:00