fix(gateway): allow egress to ingress-nginx for JWKS

Browse Source

The service CIDR is 10.106.0.0/16, so the ipBlock 10.96.0.0/12 never covered
ingress-nginx (10.101.128.185). The JWKS fetch to zitadel.riotpiao.com therefore
hung until the context deadline: every caller got 403, and the pod failed its
liveness probe before serving traffic.

Add an egress rule for TCP 443 to the ingress-nginx namespace and point jwksUrl
back at the public host. The ZITADEL service port 8080 answers 404 for
/oauth/v2/keys, so the service endpoint is not usable.

This commit was merged in pull request #70.

...

This commit is contained in:

Admin Bot

2026-10-27 01:37:08 -07:00

parent 6acaec4a5c

commit 67fe20d7a3

2 changed files with 13 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/gateway-config-secret.yaml

+1 -1

File diff suppressed because one or more lines are too long