Add paldocs to Postgres NetworkPolicy allowlist #397

New issue

Closed

opened 2026-06-03 03:40:35 +00:00 by ldraney · 0 comments

ldraney commented

2026-06-03 03:40:35 +00:00

Owner

Type

Bug

Lineage

Discovered during paldocs deployment investigation. paldocs was onboarded via pal-e-services Terraform but the NetworkPolicy update in pal-e-platform was missed.

Repo

ldraney/pal-e-platform

What Broke

paldocs pod crashes with PG::ConnectionBad: connection refused when trying to reach Postgres. The paldocs namespace is not in the default-deny-ingress NetworkPolicy allowlist for the postgres namespace in terraform/network-policies.tf.

Repro Steps

Deploy paldocs pod in the paldocs namespace
Pod runs Rails server boot connecting to pal-e-postgres-rw.postgres.svc.cluster.local:5432
Connection refused — NetworkPolicy blocks ingress from paldocs namespace

Expected Behavior

paldocs namespace should be in the Postgres NetworkPolicy allowlist, same as other services that connect to the shared paledocs database (pal-e-docs, pal-e-ror, palinks, etc.).

Environment

Cluster: archbox k3s
NetworkPolicy: default-deny-ingress in postgres namespace
Terraform resource: kubernetes_manifest.netpol_postgres in network-policies.tf

Acceptance Criteria

paldocs added to netpol_postgres ingress rules in network-policies.tf
tofu plan shows only the expected netpol diff

service-onboarding-sop step 4: "Update NetworkPolicy for dependent services"

### Type Bug ### Lineage Discovered during paldocs deployment investigation. paldocs was onboarded via pal-e-services Terraform but the NetworkPolicy update in pal-e-platform was missed. ### Repo `ldraney/pal-e-platform` ### What Broke paldocs pod crashes with `PG::ConnectionBad: connection refused` when trying to reach Postgres. The `paldocs` namespace is not in the `default-deny-ingress` NetworkPolicy allowlist for the `postgres` namespace in `terraform/network-policies.tf`. ### Repro Steps 1. Deploy paldocs pod in the `paldocs` namespace 2. Pod runs Rails server boot connecting to `pal-e-postgres-rw.postgres.svc.cluster.local:5432` 3. Connection refused — NetworkPolicy blocks ingress from `paldocs` namespace ### Expected Behavior paldocs namespace should be in the Postgres NetworkPolicy allowlist, same as other services that connect to the shared paledocs database (pal-e-docs, pal-e-ror, palinks, etc.). ### Environment - Cluster: archbox k3s - NetworkPolicy: `default-deny-ingress` in `postgres` namespace - Terraform resource: `kubernetes_manifest.netpol_postgres` in `network-policies.tf` ### Acceptance Criteria - [ ] `paldocs` added to `netpol_postgres` ingress rules in `network-policies.tf` - [ ] `tofu plan` shows only the expected netpol diff ### Related - service-onboarding-sop step 4: "Update NetworkPolicy for dependent services"