fix: allow argocd namespace ingress to Harbor #161

Merged

forgejo_admin merged 1 commit from 148-harbor-argocd-netpol into main

2026-03-26 03:42:46 +00:00

forgejo_admin commented

2026-03-25 13:39:42 +00:00

Owner

Summary

ArgoCD Image Updater needs to reach Harbor to check for new image tags. The Harbor NetworkPolicy was missing argocd from its ingress allowlist, causing connection timeouts.

Changes

terraform/network-policies.tf: Added argocd namespace to netpol_harbor ingress rules alongside existing tailscale, harbor, monitoring, and woodpecker entries.

Test Plan

Apply with tofu apply -target=kubernetes_manifest.netpol_harbor
Verify ArgoCD Image Updater logs no longer show connection timeouts to Harbor
Confirm kubectl get networkpolicy -n harbor default-deny-ingress -o yaml includes the argocd namespace selector
No regressions in other Harbor access (Woodpecker pushes, Tailscale UI)

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

Closes #148

## Summary ArgoCD Image Updater needs to reach Harbor to check for new image tags. The Harbor NetworkPolicy was missing `argocd` from its ingress allowlist, causing connection timeouts. ## Changes - `terraform/network-policies.tf`: Added `argocd` namespace to `netpol_harbor` ingress rules alongside existing tailscale, harbor, monitoring, and woodpecker entries. ## Test Plan - [ ] Apply with `tofu apply -target=kubernetes_manifest.netpol_harbor` - [ ] Verify ArgoCD Image Updater logs no longer show connection timeouts to Harbor - [ ] Confirm `kubectl get networkpolicy -n harbor default-deny-ingress -o yaml` includes the argocd namespace selector - [ ] No regressions in other Harbor access (Woodpecker pushes, Tailscale UI) ## Review Checklist - [x] Passed automated review-fix loop - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive ## Related - Closes #148

forgejo_admin added 1 commit

2026-03-25 13:39:42 +00:00

fix: allow argocd namespace ingress to Harbor for Image Updater

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

14ceb75d6e

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

forgejo_admin commented

2026-03-25 13:40:01 +00:00

Author

Owner

Review: LGTM

Diff: +1 line, 1 file changed. Minimal and correct.

Findings:

The new argocd ingress rule follows the exact same namespaceSelector pattern as the existing tailscale, harbor, monitoring, and woodpecker entries. Consistent.
No secrets, no extraneous changes, no formatting drift.
Correctly targets netpol_harbor resource only.

No issues found. Ready for merge.

## Review: LGTM **Diff:** +1 line, 1 file changed. Minimal and correct. **Findings:** - The new `argocd` ingress rule follows the exact same `namespaceSelector` pattern as the existing tailscale, harbor, monitoring, and woodpecker entries. Consistent. - No secrets, no extraneous changes, no formatting drift. - Correctly targets `netpol_harbor` resource only. **No issues found.** Ready for merge.