fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes

2026-08-18 15:08:03 -07:00
parent aea48deb99
commit 5b3307ffee
19 changed files with 520 additions and 382 deletions
@@ -0,0 +1,49 @@
+# NetworkPolicy for CNPG pods - allow pod-to-pod replication traffic
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: forgejo-db-allow-replication
+  namespace: cicd
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: forgejo-db
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow CNPG operator to reach instance status endpoints (port 8000)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+      ports:
+        - protocol: TCP
+          port: 8000
+    # Allow PostgreSQL connections from application pods (Forgejo)
+    - from:
+        - podSelector: {}
+          namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cicd
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow PostgreSQL replication from other CNPG pods
+    - from:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: forgejo-db
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow metrics scraping
+    - from:
+        - namespaceSelector: {}
+      ports:
+        - protocol: TCP
+          port: 9187
+  egress:
+    # Allow all egress (CNPG needs to reach services, API server, DNS, etc.)
+    # Restricting egress breaks replication through services
+    - {}