fix: add pal-e-docs namespace to postgres NetworkPolicy #284

New issue

Open

opened 2026-04-12 17:56:31 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-04-12 17:56:31 +00:00

Contributor

Type

Bug

Lineage

Discovered during CORS fix deployment. pal-e-docs API pods cannot connect to postgres after restart.

Repo

forgejo_admin/pal-e-platform

What Broke

The postgres default-deny-ingress NetworkPolicy in terraform/network-policies.tf allows ingress from pal-e-production, basketball-api, cnpg-system, and monitoring — but NOT from pal-e-docs. The pal-e-docs API pod was surviving on a 14-day-old persistent TCP connection. When the pod restarted with the CORS fix, new connections were refused. Patched manually with kubectl patch.

Repro Steps

Restart pal-e-docs pod (any reason — deploy, crash, ArgoCD sync)
Pod runs alembic upgrade head at startup, tries to connect to postgres
Connection refused — NetworkPolicy blocks ingress from pal-e-docs namespace
Pod enters CrashLoopBackOff

Expected Behavior

pal-e-docs pods can connect to postgres after restart.

Environment

Cluster/namespace: prod / postgres
File: terraform/network-policies.tf line 172
Manual fix applied: kubectl patch networkpolicy — will be reverted by next tofu apply

Acceptance Criteria

pal-e-docs namespace added to postgres NetworkPolicy ingress rules in network-policies.tf
tofu plan -lock=false shows the expected change
After tofu apply, pal-e-docs pods can connect to postgres

project-pal-e-platform — platform project
forgejo_admin/pal-e-api #258 — CORS fix that triggered the pod restart

### Type Bug ### Lineage Discovered during CORS fix deployment. pal-e-docs API pods cannot connect to postgres after restart. ### Repo `forgejo_admin/pal-e-platform` ### What Broke The postgres `default-deny-ingress` NetworkPolicy in `terraform/network-policies.tf` allows ingress from `pal-e-production`, `basketball-api`, `cnpg-system`, and `monitoring` — but NOT from `pal-e-docs`. The pal-e-docs API pod was surviving on a 14-day-old persistent TCP connection. When the pod restarted with the CORS fix, new connections were refused. Patched manually with `kubectl patch`. ### Repro Steps 1. Restart pal-e-docs pod (any reason — deploy, crash, ArgoCD sync) 2. Pod runs `alembic upgrade head` at startup, tries to connect to postgres 3. Connection refused — NetworkPolicy blocks ingress from pal-e-docs namespace 4. Pod enters CrashLoopBackOff ### Expected Behavior pal-e-docs pods can connect to postgres after restart. ### Environment - Cluster/namespace: prod / postgres - File: `terraform/network-policies.tf` line 172 - Manual fix applied: `kubectl patch networkpolicy` — will be reverted by next `tofu apply` ### Acceptance Criteria - [ ] `pal-e-docs` namespace added to postgres NetworkPolicy ingress rules in `network-policies.tf` - [ ] `tofu plan -lock=false` shows the expected change - [ ] After `tofu apply`, pal-e-docs pods can connect to postgres ### Related - `project-pal-e-platform` — platform project - `forgejo_admin/pal-e-api #258` — CORS fix that triggered the pod restart