From cf24a1a396303ff8e80d847abda9d3c4a64501e2 Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Tue, 28 Jul 2026 15:13:21 +0200 Subject: [PATCH] fix: Correct authentik-server NetworkPolicy ports (container port, not Service port) Caused a live 502 immediately after deploy: the rule allowed 80/443 (the Service's external ports), but NetworkPolicy filters on the pod's actual container port after kube-proxy's DNAT - authentik-server's Service maps 80->9000 and 443->9443. Confirmed root cause by suspending Flux reconciliation (it was silently re-applying my manual test deletions) and testing with the policies truly absent. --- apps/authentik/networkpolicy.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/authentik/networkpolicy.yaml b/apps/authentik/networkpolicy.yaml index 96190a8..00ebe4e 100644 --- a/apps/authentik/networkpolicy.yaml +++ b/apps/authentik/networkpolicy.yaml @@ -38,10 +38,12 @@ spec: matchLabels: kubernetes.io/metadata.name: matrix ports: + # NetworkPolicy matches the pod's actual container port, not the Service's + # external port - the authentik-server Service maps 80->9000, 443->9443. - protocol: TCP - port: 80 + port: 9000 - protocol: TCP - port: 443 + port: 9443 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy