From 8cd7615eea0f1154045777947ada6769e9d37e21 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Thu, 24 Sep 2026 00:54:40 +0200
Subject: [PATCH] RPF-WP-0047: allow Traefik to reach the cert-manager HTTP-01
 solver (8089)

The isolation policy blocked the solver pod, so the challenge got 502.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
---
 .../platform-addons/bao-notice/manifests.yaml | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/argocd/platform-addons/bao-notice/manifests.yaml b/argocd/platform-addons/bao-notice/manifests.yaml
index 6d83945..755857b 100644
--- a/argocd/platform-addons/bao-notice/manifests.yaml
+++ b/argocd/platform-addons/bao-notice/manifests.yaml
@@ -28,6 +28,29 @@ spec:
     - {protocol: TCP, port: 8080}
   egress: []
 ---
+# cert-manager HTTP-01 solver pods run in this namespace on 8089 during
+# issuance and renewal; Traefik must reach them or the challenge gets 502.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bao-notice-acme-solver
+  namespace: bao-notice
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes: [Ingress]
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+    ports:
+    - {protocol: TCP, port: 8089}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata: