claude/k8s-apps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow Kyverno egress to Gitea external for registry token exchange
All checks were successful
AI Review / AI Code Review (pull_request) Successful in 1s
Details
PR Checks / Validate & Security Scan (pull_request) Successful in 9s
Details

Browse Source 
After changing Gitea ROOT_URL to https://git.georgepet.duckdns.org,
the registry V2 auth challenge redirects to the external URL.
Kyverno needs to reach 185.47.204.231:443 for token exchange.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
claude 2026-02-24 21:29:00 +01:00
parent cd49407c75
commit 17e55ae0c9
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
apps/infra-network-policies/kyverno.yaml
View File

@ -59,6 +59,13 @@ spec:
ports: ports:
- port: 3000 - port: 3000
protocol: TCP protocol: TCP
# Gitea external (registry token exchange via ROOT_URL)
- to:
- ipBlock:
cidr: 185.47.204.231/32
ports:
- port: 443
protocol: TCP
--- ---
# Background controller: K8s API + registry # Background controller: K8s API + registry
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
@ -84,6 +91,13 @@ spec:
ports: ports:
- port: 3000 - port: 3000
protocol: TCP protocol: TCP
# Gitea external (registry token exchange via ROOT_URL)
- to:
- ipBlock:
cidr: 185.47.204.231/32
ports:
- port: 443
protocol: TCP
--- ---
# Cleanup controller: K8s API only # Cleanup controller: K8s API only
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1