From a55e4c7b4325c05bed3b8f35bb8e7ef67825d837 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Fri, 4 Sep 2026 19:09:43 -0700
Subject: [PATCH] fix: use pod ports (9000/9443) for authentik egress, not
 service ports

---
 k8s/network-policy.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 8ce0f12..e0323aa 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -86,15 +86,18 @@ spec:
     - protocol: TCP
       port: 8080
   # Allow to IAM (Authentik) for JWKS fetch + API
+  # Authentik pod listens on 9000 (http) and 9443 (https)
+  # Service translates 80→9000, 443→9443
+  # NetworkPolicy matches destination pod port, not service port
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: iam
     ports:
     - protocol: TCP
-      port: 80
+      port: 9000
     - protocol: TCP
-      port: 443
+      port: 9443
   # Allow to SQS (queue management service)
   - to:
     - namespaceSelector: