fix: use pod ports (9000/9443) for authentik egress, not service ports

2026-09-04 19:09:43 -07:00
parent d998d7e63c
commit a55e4c7b43
1 changed files with 5 additions and 2 deletions
@@ -86,15 +86,18 @@ spec:
    - protocol: TCP
      port: 8080
  # Allow to IAM (Authentik) for JWKS fetch + API
+  # Authentik pod listens on 9000 (http) and 9443 (https)
+  # Service translates 80→9000, 443→9443
+  # NetworkPolicy matches destination pod port, not service port
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: iam
    ports:
    - protocol: TCP
-      port: 80
+      port: 9000
    - protocol: TCP
-      port: 443
+      port: 9443
  # Allow to SQS (queue management service)
  - to:
    - namespaceSelector: