2 Commits

Include renames

Author	SHA1	Message	Date
jakman85	7e8ae472c9	fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags ... Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01 baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex image tags (bad pins -> :latest; Renovate/update policy pins later).	2026-08-25 09:02:05 -05:00
jakman85andClaude Opus 4.8	0f12950831	Onboard arr apps (Sonarr + Radarr) via ServiceDefinition renderer ... Add catalog/sonarr.yaml and catalog/radarr.yaml ServiceDefinitions and their rendered apps/*.yaml manifests, wired into apps/kustomization.yaml. - exposure: internal, egress: vpn (R-NET-05/06 VPN + kill-switch, ADR-0015) - auth: forward-auth, groups: media-users (R-IDP-02/06) - dependencies -> qbittorrent:8080, jackett:9117 as explicit east-west CiliumNetworkPolicy egress allows on top of default-deny (R-NET-01/02) - config on longhorn (R-STATE-02); bulk media/downloads volume DEFERRED pending OQ-2 (bulk StorageClass is a non-provisioning stub) - observability up-SLI alert (R-OBS-01), daily-offcluster backup (R-STATE-03) Rendered with catalog/render.py --no-image-automation. Offline gates green: schema validate, kubectl kustomize apps, render.py --selftest, make -C ci gate. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-25 08:32:39 -05:00