fix(gateway): allow egress to ingress-nginx for JWKS

The service CIDR is 10.106.0.0/16, so the ipBlock 10.96.0.0/12 never covered ingress-nginx (10.101.128.185). The JWKS fetch to zitadel.riotpiao.com therefore hung until the context deadline: every caller got 403, and the pod failed its liveness probe before serving traffic. Add an egress rule for TCP 443 to the ingress-nginx namespace and point jwksUrl back at the public host. The ZITADEL service port 8080 answers 404 for /oauth/v2/keys, so the service endpoint is not usable.
fix(gateway): fetch JWKS from the in-cluster ZITADEL service
2026-10-27 01:37:08 -07:00 · 2026-10-27 01:28:10 -07:00
2 changed files with 13 additions and 1 deletions
@@ -172,6 +172,18 @@ spec:
    ports:
    - protocol: TCP
      port: 3000
+  # Allow HTTPS to ingress-nginx. The gateway fetches JWKS and the OIDC
+  # discovery document from https://zitadel.riotpiao.com, which CoreDNS rewrites
+  # to this service. The service CIDR is 10.106.0.0/16, so the 10.96.0.0/12
+  # ipBlock below never covered it: the fetch hung until the context deadline and
+  # the pod failed its liveness probe.
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-nginx
+    ports:
+    - protocol: TCP
+      port: 443
  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA).
  # kube-apiserver runs on host network (192.168.1.162/166:6443) — must use ipBlock.
  # ClusterIP 10.96.0.1:443 also routes there, covered by the 10.96.0.0/12 CIDR.