home-network-k3s-impl

325 Commits 139 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 4.8	b871877c1b	fix(render): namespace-pin east-west selectors so declared deps actually connect Follow-up to the reciprocal-ingress fix: in-cluster verification (Hubble) revealed the east-west path was STILL fully blocked — and that the pre-existing EGRESS half was also broken, contrary to the original diagnosis. Root cause: a CiliumNetworkPolicy `toEndpoints`/`fromEndpoints` selector is scoped to the POLICY's OWN namespace unless it carries the reserved `k8s:io.kubernetes.pod.namespace` label. Every service lives in its own namespace (== its name) and every dependency crosses a namespace boundary, so an app-label-only peer selector matched nothing and Cilium silently denied the flow (Hubble: sonarr->qbittorrent = "EGRESS DENIED ... Policy denied DROPPED"). Pin the peer namespace on BOTH halves — egress toEndpoints (destination ns == dep.to) and the reciprocal ingress fromEndpoints (source ns == source name). This is a strict TIGHTENING (more precise, still L3/L4), not a weakening. Verified end-to-end in-cluster: sonarr->qbittorrent:8080, sonarr->jackett:9117, seerr->{sonarr:8989,radarr:7878, plex:32400} now CONNECT (were DROPPED); undeclared sonarr->plex:32400 and seerr->qbittorrent:8080 stay BLOCKED (default-deny holds). Selftest + L0 (17/17) + L1 (3/3, goldens byte-identical) + lint all pass. NOTE: this necessarily touches the egress toEndpoints selector, which the task scoped as ingress-only; the premise that egress already worked was empirically false. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-26 01:01:56 -05:00
jakman85andClaude Opus 4.8	b6f72eab0c	feat(apps): onboard seerr (Overseerr request UI) — completes arr↔seerr↔plex graph Phase 6: add the seerr ServiceDefinition and its rendered manifests. seerr is the final missing node in the media dependency graph (docs/13 row 5; docs/03 allow rules). - catalog/seerr.yaml: public \| egress internet \| config on longhorn (5Gi) \| auth native (Plex accounts, documented SSO exception, docs/15) \| 3 explicit egress deps: sonarr:8989, radarr:7878, plex:32400. No bulk volume (OQ-2 unresolved). - apps/seerr.yaml: rendered via catalog/render.py --no-image-automation (default-deny DNS-only baseline + 3 dep CiliumNetworkPolicies + gateway-ingress + internet world egress + HTTPRoute seerr.home.keithjackson.dev:5055 + ServiceMonitor + alerts). - apps/kustomization.yaml: add seerr.yaml (with the arr/media stack). Gates: render --selftest PASS; ci lint PASS; L0 kyverno 17/17 (schema + default-deny + egress-class + auth-mode + host-ns); L1 render 3/3. Other apps byte-identical. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-08-26 00:27:47 -05:00

Author

SHA1

Message

Date

jakman85andClaude Opus 4.8

b871877c1b

fix(render): namespace-pin east-west selectors so declared deps actually connect

Follow-up to the reciprocal-ingress fix: in-cluster verification (Hubble) revealed
the east-west path was STILL fully blocked — and that the pre-existing EGRESS half
was also broken, contrary to the original diagnosis. Root cause: a CiliumNetworkPolicy
`toEndpoints`/`fromEndpoints` selector is scoped to the POLICY's OWN namespace unless
it carries the reserved `k8s:io.kubernetes.pod.namespace` label. Every service lives
in its own namespace (== its name) and every dependency crosses a namespace boundary,
so an app-label-only peer selector matched nothing and Cilium silently denied the flow
(Hubble: sonarr->qbittorrent = "EGRESS DENIED ... Policy denied DROPPED").

Pin the peer namespace on BOTH halves — egress toEndpoints (destination ns == dep.to)
and the reciprocal ingress fromEndpoints (source ns == source name). This is a strict
TIGHTENING (more precise, still L3/L4), not a weakening. Verified end-to-end in-cluster:
sonarr->qbittorrent:8080, sonarr->jackett:9117, seerr->{sonarr:8989,radarr:7878,
plex:32400} now CONNECT (were DROPPED); undeclared sonarr->plex:32400 and
seerr->qbittorrent:8080 stay BLOCKED (default-deny holds).

Selftest + L0 (17/17) + L1 (3/3, goldens byte-identical) + lint all pass. NOTE: this
necessarily touches the egress toEndpoints selector, which the task scoped as
ingress-only; the premise that egress already worked was empirically false.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-26 01:01:56 -05:00

jakman85andClaude Opus 4.8

b6f72eab0c

feat(apps): onboard seerr (Overseerr request UI) — completes arr↔seerr↔plex graph

Phase 6: add the seerr ServiceDefinition and its rendered manifests. seerr is the
final missing node in the media dependency graph (docs/13 row 5; docs/03 allow rules).

- catalog/seerr.yaml: public | egress internet | config on longhorn (5Gi) |
  auth native (Plex accounts, documented SSO exception, docs/15) | 3 explicit egress
  deps: sonarr:8989, radarr:7878, plex:32400. No bulk volume (OQ-2 unresolved).
- apps/seerr.yaml: rendered via catalog/render.py --no-image-automation (default-deny
  DNS-only baseline + 3 dep CiliumNetworkPolicies + gateway-ingress + internet world
  egress + HTTPRoute seerr.home.keithjackson.dev:5055 + ServiceMonitor + alerts).
- apps/kustomization.yaml: add seerr.yaml (with the arr/media stack).

Gates: render --selftest PASS; ci lint PASS; L0 kyverno 17/17 (schema + default-deny +
egress-class + auth-mode + host-ns); L1 render 3/3. Other apps byte-identical.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-26 00:27:47 -05:00