gitadmin/fxhnt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(migrate): allow dagster tailscale sidecar egress to kube-apiserver

Browse Source 
The dagster NP's public-HTTPS rule excepts the bizworx service CIDR
(10.32.0.0/16), which contains the apiserver ClusterIP 10.32.0.1. The
tailscale sidecar reads/writes its ts-state Secret via
kubernetes.default.svc, so it timed out (context deadline exceeded) and
crashlooped -> pod stuck 2/3. Add a surgical 10.32.0.1/32:443 egress
allow. daemon+webserver were always healthy; sidecar-only fix -> now 3/3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Jeroen Grusewski
2026-07-18 18:15:24 +00:00
parent 30e62675fc
commit 06d12fd4e3
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
infra/k8s/orchestration/dagster.yaml
View File

@@ -204,5 +204,7 @@ spec:
- to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }] # git-sync clones from the bizworx gitea in ns gitea (cross-namespace)
ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
- ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
- to: [{ ipBlock: { cidr: 10.32.0.1/32 } }] # kube-apiserver ClusterIP: the tailscale sidecar reads/writes its ts-state Secret via kubernetes.default.svc (the public-HTTPS rule below excepts the service CIDR)
ports: [{ port: 443, protocol: TCP }]
- to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }] # Binance/Databento + tailscale
ports: [{ port: 443, protocol: TCP }, { port: 3478, protocol: UDP }, { port: 41641, protocol: UDP }]