From d9ef54dc99ae08986a0377f7f528fb278595edcb Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Fri, 21 Aug 2026 12:00:00 +0000 Subject: [PATCH] =?UTF-8?q?netpol:=20wave=201=20=E2=80=94=20six=20deploy?= =?UTF-8?q?=20and=20helper=20workloads=20lose=20their=20outbound=20(#0088)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit matrix-rtc-authorisation-service, wikijs-config, init-secrets, synapse-check-config and both deployment markers have no demonstrable need to leave the cluster. They now get DNS plus the pod and service networks and nothing else. The name goes into BOTH lists, and that is the whole point: NetworkPolicies are additive, so as long as the broad policy still selects a pod and allows 0.0.0.0/0, a second and stricter rule for the same pod changes nothing. The file already carried that warning as a comment; this change obeys it rather than rediscovering it. Checked before pushing: both selector lists are congruent - no workload is excluded from the broad rule without receiving the narrow one, and none the other way round. A one-sided entry would either open a pod completely or cut it off entirely, and neither shows up as a syntax error. Class A is deliberately the first wave: these workloads run at deploy time, so a mistake surfaces at the next rollout rather than in a user's face. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM --- apps/production/networkpolicy.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/apps/production/networkpolicy.yaml b/apps/production/networkpolicy.yaml index 995e5ad..a11c781 100644 --- a/apps/production/networkpolicy.yaml +++ b/apps/production/networkpolicy.yaml @@ -461,6 +461,13 @@ spec: - wikijs-gruppenpruefung - haproxy - draupnir + # Welle 1 (#0088): kein externer Bedarf nachweisbar. + - matrix-rtc-authorisation-service + - wikijs-config + - init-secrets + - synapse-check-config + - deployment-markers-pre + - deployment-markers-post - key: app operator: NotIn values: @@ -526,6 +533,13 @@ spec: - wikijs-gruppenpruefung - haproxy - draupnir + # Welle 1 (#0088): Deploy- und Hilfs-Arbeitslasten. + - matrix-rtc-authorisation-service + - wikijs-config + - init-secrets + - synapse-check-config + - deployment-markers-pre + - deployment-markers-post policyTypes: - Egress egress: