From 703cf1ff1cfc25b15e7c5c07d70c8256d7850aa5 Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Tue, 28 Jul 2026 15:27:45 +0200 Subject: [PATCH] fix: Allow synapse-main to reach MAS's port 8080 for token introspection Second port-config incident from this rollout: synapse calls MAS's oauth2/introspect endpoint on port 8080 (not 8081 as assumed) for every single authenticated request (sync, pushrules, capabilities, etc). The rule only allowed kube-system (Traefik) on 8080, so every authenticated API call failed with 503 "Unable to introspect the access token" - all clients showed a lost connection. Patched live immediately, this commit brings Git back in sync with that patch. --- apps/production/networkpolicy.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/production/networkpolicy.yaml b/apps/production/networkpolicy.yaml index 7b4aa44..e8d1439 100644 --- a/apps/production/networkpolicy.yaml +++ b/apps/production/networkpolicy.yaml @@ -128,6 +128,9 @@ spec: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: kube-system + - podSelector: + matchLabels: + app.kubernetes.io/name: synapse-main ports: - protocol: TCP port: 8080