From c1c189d281afc8461c29bbb6f90ba934321bea0c Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Tue, 28 Jul 2026 21:26:15 +0200 Subject: [PATCH] fix(turn-rotation): add hostAliases for private-network Gitea access Job hung indefinitely on git clone - public-internet reachability to rohana.axion1337.de from inside pods is currently down (related to Issue #41's firewall/private-network findings), and the node-level /etc/hosts workaround only helps containerd's image pulls, not processes running inside pods (they resolve via CoreDNS + their own /etc/hosts, not the node's). hostAliases routes this job's git/API traffic over the private Hetzner network directly - verified working with a real pod. Co-Authored-By: Claude Sonnet 5 --- apps/production/turn-secret-rotation.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apps/production/turn-secret-rotation.yaml b/apps/production/turn-secret-rotation.yaml index 95802f4..2f7101b 100644 --- a/apps/production/turn-secret-rotation.yaml +++ b/apps/production/turn-secret-rotation.yaml @@ -24,6 +24,13 @@ spec: app.kubernetes.io/component: rotation spec: restartPolicy: OnFailure + # Public-internet reachability to the Gitea host has been flaky (see Issue #41); + # both servers share a private Hetzner network. hostAliases (unlike the node-level + # /etc/hosts fix used for image pulls) is actually honored by in-pod processes. + hostAliases: + - ip: "10.0.0.3" + hostnames: + - "rohana.axion1337.de" containers: - name: rotate image: rohana.axion1337.de/sorb/axion-secret-rotation:v1