From 609c573efcaa167b805c0fd7d490e660f3f4a747 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Sat, 2 May 2026 10:45:21 +0200 Subject: [PATCH] fix(argo): refresh-deps-cache uses ci-pipeline egress label compile-and-deploy netpol allows port 2222 (gitlab-shell) and 8181 (webservice) but NOT port 5000 (gitlab-registry). The deps-cache build needs port 5000 to push the resulting image, so kaniko was failing with: dial tcp 10.32.4.209:5000: i/o timeout. ci-pipeline netpol (used by build-ci-image-template, which also pushes to gitlab-registry via kaniko) does allow port 5000 to app: registry. Reuse that label. --- infra/k8s/argo/refresh-deps-cache-template.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/infra/k8s/argo/refresh-deps-cache-template.yaml b/infra/k8s/argo/refresh-deps-cache-template.yaml index 3bcc33218..309553a8b 100644 --- a/infra/k8s/argo/refresh-deps-cache-template.yaml +++ b/infra/k8s/argo/refresh-deps-cache-template.yaml @@ -25,11 +25,10 @@ spec: entrypoint: build podMetadata: labels: - # Reuse compile-and-deploy's egress allow-list (gitlab-shell:2222 for + # Reuse ci-pipeline label so the pod inherits argo-ci-pipeline netpol egress # clone, gitlab-registry:5000 for image push, crates.io HTTPS for cargo - # fetch). A dedicated `deps-cache-build` label would need a separate # NetworkPolicy clone — same egress targets, no functional difference. - app.kubernetes.io/component: compile-and-deploy + app.kubernetes.io/component: ci-pipeline app.kubernetes.io/part-of: foxhunt ttlStrategy: secondsAfterCompletion: 7200