From 17839eeeab4aef6a03e948e7f10740c4408d3c91 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 21:00:44 +0100 Subject: [PATCH] docs(trmnl): note the expected Google drops from the renderer's Chromium About 43k POLICY_DENIED a day from trmnl-renderer to Google update and account hosts. Source (OCI label): usetrmnl/trmnl-home-assistant dd556e6; the Chromium flags are a fixed list in screenshot.ts:78 with no env or option override, and --disable-background-networking is not among them. Nothing on our side can switch it off; the denies are correct. S28-4 Co-Authored-By: Claude Opus 5.5 --- kubernetes/infrastructure/network-policies/trmnl-ns.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml index 021f962a..a2f541b6 100644 --- a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml +++ b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml @@ -160,6 +160,12 @@ spec: --- # In-cluster + DNS for every pod except terminus (terminus-egress is its # allowlist; selecting it here would widen it to all of `cluster`). +# +# trmnl-renderer's Chromium calls clients2.google.com:80, +# update.googleapis.com:443 and accounts.google.com:443; these drops are +# expected and harmless. The launch flags are fixed in upstream +# trmnl-ha/ha-trmnl/screenshot.ts (PUPPETEER_ARGS, no override) and lack +# --disable-background-networking. apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: -- 2.54.0