From bbbd556a26bb8918ff712db6c853c246b584ed72 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 24 Apr 2026 22:36:31 +0200 Subject: [PATCH] fix(ingress): allow ingress-nginx egress to coder namespace The per-ingress-nginx egress CNP enumerates app namespaces; coder was missing, so requests to coder.renner.uno dead-ended at "upstream timed out" even though coder's own CNP allowed the inbound side. Add coder to the allowlist, matching the other apps. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../infrastructure/network-policies/ingress-isolation.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml index 9c94010a..80fdc176 100644 --- a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml +++ b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml @@ -67,6 +67,9 @@ spec: - toEndpoints: - matchLabels: "k8s:io.kubernetes.pod.namespace": immich + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": coder # Reach CrowdSec LAPI - toEndpoints: - matchLabels: -- 2.54.0