From 5f3aecb381b5906e0979ef9c6c0b0cfddc045f14 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 17 Sep 2026 10:29:53 +0200 Subject: [PATCH] fix(external-dns): let Prometheus reach the metrics port MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ServiceMonitor added in #865 discovers both external-dns targets and then times out on them: the apps namespace is default-deny-ingress, so the scrape never arrives. lastError: Get "http://10.244.2.218:7979/metrics": context deadline exceeded health: down Same shape as gitea-allow-metrics-scrape, and one policy covers both releases — the chart gives them the same app.kubernetes.io/name and they share the namespace, even though external-dns-unifi is declared under infrastructure/. Co-Authored-By: Claude Opus 5 (1M context) --- .../apps/external-dns/kustomization.yaml | 1 + .../apps/external-dns/networkpolicy.yaml | 22 +++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 kubernetes/apps/external-dns/networkpolicy.yaml diff --git a/kubernetes/apps/external-dns/kustomization.yaml b/kubernetes/apps/external-dns/kustomization.yaml index 8e3a1ec0..3e16e232 100644 --- a/kubernetes/apps/external-dns/kustomization.yaml +++ b/kubernetes/apps/external-dns/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - externalsecret.yaml - helmrelease.yaml + - networkpolicy.yaml diff --git a/kubernetes/apps/external-dns/networkpolicy.yaml b/kubernetes/apps/external-dns/networkpolicy.yaml new file mode 100644 index 00000000..4c258cee --- /dev/null +++ b/kubernetes/apps/external-dns/networkpolicy.yaml @@ -0,0 +1,22 @@ +# The apps namespace is default-deny-ingress, so the ServiceMonitor added in +# monitoring-rules/external-dns-servicemonitor.yaml scraped into a timeout. +# The selector matches both releases — the Cloudflare one deployed here and +# external-dns-unifi from infrastructure/ — since they share the chart's +# app.kubernetes.io/name and land in the same namespace. +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: external-dns-allow-metrics-scrape + namespace: apps +spec: + endpointSelector: + matchLabels: + app.kubernetes.io/name: external-dns + ingress: + - fromEndpoints: + - matchLabels: + k8s:io.kubernetes.pod.namespace: monitoring + toPorts: + - ports: + - port: "7979" + protocol: TCP -- 2.54.0