mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Sonnet 5
e18308b750
n8n's allow-n8n-access AuthorizationPolicy only allowed traffic from the n8n/istio-system/prometheus namespaces - unlike nextcloud/authentik's policies, it was missing the broader ipBlocks: 10.244.0.0/16 fallback rule. The CNPG operator (cnpg-system namespace) polling pg-n8n instances' status API (port 8000) wasn't covered by any rule, so Istio's L4 authorization enforcement (via ztunnel - this traffic is direct pod-IP, not routed through a Service, so waypoint/L7 never sees it) rejected the connection outright, surfacing as a TCP reset to the operator. This was the actual cause of pg-n8n's long-recurring 'Instance Status Extraction Error' - confirmed 100% reproducible tonight (every single operator poll attempt failed identically), not the intermittent HBONE-tunnel issue it resembled from the outside. Also labeled the n8n namespace istio.io/use-waypoint=waypoint (was in the enrollment script's namespace list but the label was missing live - namespace parity fix, though not itself the fix for this specific issue since this traffic bypasses the waypoint). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>