tegwick
e29f430b8d
- gitea-db-networkpolicies.yaml: allow-egress-kube-api and allow-ingress-from-cnpg-operator for gitea-db cluster pods; required because databases namespace has default-deny-all policy and existing allow rules only covered net-kingdom-pg - valkey-values.sops.yaml.template: standalone Valkey Helm values template with Gitea connection string documentation - .gitignore: allow *-networkpolicies.yaml alongside *-cluster.yaml Fixes gitea-db initdb failure (T03); gitea-db cluster now healthy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
43 lines
1,005 B
YAML
43 lines
1,005 B
YAML
# NetworkPolicies for gitea-db cnpg cluster
|
|
# The databases namespace has a default-deny-all policy; each cluster needs
|
|
# explicit egress-to-kube-api and ingress-from-cnpg-operator policies.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-kube-api-gitea-db
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: gitea-db
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- ports:
|
|
- port: 6443
|
|
protocol: TCP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-from-cnpg-operator-gitea-db
|
|
namespace: databases
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: gitea-db
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cnpg-system
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
- port: 8000
|
|
protocol: TCP
|
|
- port: 9187
|
|
protocol: TCP
|