From 06d12fd4e3e05da57acd4a4e981b689dde566ade Mon Sep 17 00:00:00 2001 From: Jeroen Grusewski Date: Sat, 18 Jul 2026 18:15:24 +0000 Subject: [PATCH] fix(migrate): allow dagster tailscale sidecar egress to kube-apiserver The dagster NP's public-HTTPS rule excepts the bizworx service CIDR (10.32.0.0/16), which contains the apiserver ClusterIP 10.32.0.1. The tailscale sidecar reads/writes its ts-state Secret via kubernetes.default.svc, so it timed out (context deadline exceeded) and crashlooped -> pod stuck 2/3. Add a surgical 10.32.0.1/32:443 egress allow. daemon+webserver were always healthy; sidecar-only fix -> now 3/3. Co-Authored-By: Claude Opus 4.8 --- infra/k8s/orchestration/dagster.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/k8s/orchestration/dagster.yaml b/infra/k8s/orchestration/dagster.yaml index e75ba33..5514740 100644 --- a/infra/k8s/orchestration/dagster.yaml +++ b/infra/k8s/orchestration/dagster.yaml @@ -204,5 +204,7 @@ spec: - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }] # git-sync clones from the bizworx gitea in ns gitea (cross-namespace) ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }] - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }] + - to: [{ ipBlock: { cidr: 10.32.0.1/32 } }] # kube-apiserver ClusterIP: the tailscale sidecar reads/writes its ts-state Secret via kubernetes.default.svc (the public-HTTPS rule below excepts the service CIDR) + ports: [{ port: 443, protocol: TCP }] - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }] # Binance/Databento + tailscale ports: [{ port: 443, protocol: TCP }, { port: 3478, protocol: UDP }, { port: 41641, protocol: UDP }]