From 0de50c2a50eb1f59483b1767160edf4cae177149 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 24 Apr 2026 22:42:33 +0200 Subject: [PATCH] fix(coder): allow coder pod egress to ingress-nginx Coder pods initiate OIDC discovery against auth.renner.uno, which resolves to the ingress-nginx LB. Cilium policy evaluates destination at the pod endpoint, not the LB VIP, so we need to explicitly allow egress to the ingress-nginx endpoint. Matches audiobookshelf-ns.yaml. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/infrastructure/network-policies/coder-ns.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kubernetes/infrastructure/network-policies/coder-ns.yaml b/kubernetes/infrastructure/network-policies/coder-ns.yaml index ae5729ca..52a0036c 100644 --- a/kubernetes/infrastructure/network-policies/coder-ns.yaml +++ b/kubernetes/infrastructure/network-policies/coder-ns.yaml @@ -24,6 +24,11 @@ spec: - toEndpoints: - matchLabels: "k8s:io.kubernetes.pod.namespace": coder + # Coder reaches auth.renner.uno (OIDC discovery) via ingress-nginx. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": ingress + app.kubernetes.io/name: ingress-nginx - toEndpoints: - matchLabels: "k8s:io.kubernetes.pod.namespace": rook-ceph -- 2.54.0