Thore CimbalandClaude Sonnet 5
e54ec10fd9
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Closes issue #37. The Bitnami postgresql subchart's auto-generated NetworkPolicy restricted the port (5432) but not the source - any pod in any namespace could reach it, since additive NetworkPolicy rules can't restrict an existing permissive one, only the chart itself controls it (hence not touched during the original #10 rollout). Disabled via postgresql.primary.networkPolicy.enabled: false and replaced with a scoped policy allowing only authentik-server and authentik-worker (same namespace) on 5432, matching the pattern already used for the matrix namespace's postgres access. No metrics exporter is enabled for this instance, so no monitoring-namespace rule is needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>