Story Crater Bot
8d63db9f3b
- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml) - Remove helm install --wait flag (talos-cp-2 slow node timeout issue) - Add comprehensive progress logging with timestamps to bootstrap.sh - Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key) - Add local SOPS decryption for bootstrap secrets - Add CNPG NetworkPolicy allowing app→database connectivity - Disable Forgejo bundled dependencies (saves 66Gi storage) - Inject database credentials via deployment.env (GITEA__DATABASE__*) - Remove invalid ext4 mount options from StorageClass - Add namespace manifests with PodSecurity labels - Add encrypted forgejo-admin secret (SOPS) - Reduce forgejo-db size 50Gi→25Gi per instance - Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)
50 lines
1.3 KiB
YAML
50 lines
1.3 KiB
YAML
# NetworkPolicy for CNPG pods - allow pod-to-pod replication traffic
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: forgejo-db-allow-replication
|
|
namespace: cicd
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: forgejo-db
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
# Allow CNPG operator to reach instance status endpoints (port 8000)
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cnpg-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8000
|
|
# Allow PostgreSQL connections from application pods (Forgejo)
|
|
- from:
|
|
- podSelector: {}
|
|
namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: cicd
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
# Allow PostgreSQL replication from other CNPG pods
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
cnpg.io/cluster: forgejo-db
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
# Allow metrics scraping
|
|
- from:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9187
|
|
egress:
|
|
# Allow all egress (CNPG needs to reach services, API server, DNS, etc.)
|
|
# Restricting egress breaks replication through services
|
|
- {}
|